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Competence and capabilities includes consideration of: 

. Practical experience 

. Understanding of professional standards 

. Expertise in specialised areas of accounting and auditing 
. Expertise in IT or automated tools and techniques 

. Knowledge of relevant industries 

. Ability to exercise professional scepticism and judgement 
. Understanding of the firm’s policies and procedures 

[ISA 220 (Revised), A71] 

If insufficient resources are made available the following actions can be taken: 
. Change the planned audit approach 

. Arrange an extension to the reporting deadline 


. Follow the firm’s policies and procedures for resolving differences of 
opinion 


. Withdraw from the engagement if possible under applicable law or 
regulation. 


[ISA 220 (Revised), A78] 


KAPLAN PUBLISHING 171 


Planning 


172 


AUDIT ENGAGEMENT PARTNER 


Direction/review 


| 


AUDIT MANAGER 


Direction/supervision/review 


| 


AUDIT SUPERVISOR 


ON-SITE Direction/supervision/review 
TEAM 


ee 


AUDIT SENIOR AUDIT JUNIOR AUDIT JUNIOR 
(rd year) (2nd year) (ast year) 


E.g. Inventory E.g. Receivables/ payables E.g. Cash/NCA 


| 


Technological resources 


Technological resources include technology to conduct meetings, 
communication and automated tools and techniques. The auditor must be 
careful not to place too much reliance on those resources. 

[ISA 220 (Revised), A63] 


Intellectual resources 


Intellectual resources include audit methodologies, implementation tools, 
auditing guides, templates and checklists. These allow for consistent application 
and understanding of professional standards. 

[ISA 220 (Revised), A68, A69] 


Engagement performance 


Engagement performance comprises direction, supervision and review of the 
engagement. 


Direction involves informing team members of their responsibility to: 


. Contribute to the management and achievement of quality of the 
engagement. 


. Maintain a questioning mind and exercise professional scepticism. 


. Fulfil ethical requirements. 
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Perform audit procedures and for more experienced team members to 


direct, supervise and review the work of less experienced team members. 


Understand the objectives of the work to be performed. 


Address threats to the achievement of quality e.g. budget or resource 
constraints should not result in team members failing to perform planned 
audit procedures. 


[ISA 220 (Revised), A85] 


Supervision includes: 


Tracking the progress of the audit to ensure the objective of the work is 
achieved and adequate ongoing resources are assigned. 


Addressing issues arising and modifying the planned approach 
accordingly e.g. by reassigning planned procedures to more experienced 
team members when issues are more complex than initially anticipated. 


Identifying matters for consultation. Consultation may be required where 
the firm lacks appropriate internal expertise. 


Providing coaching to help develop skills and competencies. 


Creating an environment where engagement team members can raise 
concerns without fear of reprisal. 


[ISA 220 (Revised), A86] 


Fel 


The audit of Fast Cars Co is currently taking place. The audit team 
comprises the audit supervisor and two audit juniors. 


One of the audit juniors has only recently joined the firm and has no 
previous audit experience, therefore the audit supervisor has been 
providing on-the-job coaching, including explaining the objective and 
purpose of the procedures to be performed and the importance of 
directional testing when testing specific assertions. The supervisor is 
also available for questions from both audit juniors. 


Due to client staff not being available, there have been difficulties 
obtaining audit evidence and the audit work is behind schedule. The 
audit supervisor believes it will be difficult to complete the audit work by 
the agreed deadline and has therefore arranged for additional resource 
to help complete the outstanding work and a recently promoted 
supervisor has been assigned to the team. 


During the audit it has been identified that the audit of receivables, which 


was originally assigned to one of the audit juniors, is higher risk than 
anticipated at the planning stage and this section has now been 
reassigned to the additional supervisor. 
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Review responsibilities include consideration of whether: 


. The work has been performed in accordance with professional standards, 
policies and procedures 


. Appropriate consultations have taken place 

. The work performed supports the conclusions reached 

. The evidence obtained is sufficient and appropriate to support the auditor's 
report 

. The objectives of the engagement procedures have been achieved. 

[ISA 220 (Revised), A88] 


The engagement partner must review audit documentation at appropriate points 
during the engagement including documentation of significant matters, 
significant judgements and other matters relevant to the engagement partner's 
responsibilities. [ISA 220 (Revised), 31] 


Engagement quality review 


C) An engagement quality review (EQR) is an objective evaluation of the 
significant judgements made by the engagement team and the 
conclusions reached thereon, performed by the engagement quality 
reviewer and completed on or before the date of the engagement 
report. [ISQM 2 Engagement Quality Reviews, 13a] 


An engagement quality reviewer is a partner, other individual in the 
firm, or an external individual appointed by the firm to perform the 
engagement quality review. [ISQM 2, 13b] 


Listed entities and other high-risk clients should be subject to an engagement 
quality review. High risk clients include those which are in the public interest, 
those with unusual circumstances and risks, and those where laws or 
regulations require an EQR. 


[ISQM 1 Quality Management for Firms that Perform Audits or Reviews of 
Financial Statements, or Other Assurance or Related Services 
Engagements, 34f] 


For audit engagements where an EQR is required, the engagement partner 
must: 


. Determine that an EQR has been appointed. 


. Cooperate with the reviewer and inform other team members of their 
responsibility to do so. 


. Discuss significant matters and significant judgements arising during the 
engagement with the reviewer. 


. Not date the auditor's report until the completion of the EQR. 
[ISA 220 (Revised), 36] 
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Eligibility of Engagement Quality Reviewers: 
. Cannot be a member of the engagement team. 


. Must have the competence and capabilities, including sufficient time, and 
the appropriate authority to perform the EQR. 


. Must comply with relevant ethical requirements and laws and regulations. 
[ISQM 2, 18] 


A monitoring and remediation process must be established to provide relevant, 
reliable and timely information about the design, implementation and operation 
of the system of quality management and take appropriate actions to respond to 
identified deficiencies such that deficiencies are remediated on a timely basis. 
[ISQM 1, 35] 


In order to achieve this the firm must: 

. Establish quality objectives 

. Identify and assess quality risks 

. Design and implement responses to address quality risks. 
[ISQM 1, 23] 


The firm must monitor the system as a whole by inspecting completed 
engagements selected according to risk and taking consideration of other 
monitoring activities performed by the firm. [ISQM 1, 38] 


The firm must evaluate the severity of deficiencies and investigate the root 
cause of the deficiencies, evaluating the effect on the quality management 
system. [ISQM 1, 41] 


The firm should then appropriately remediate deficiencies responsive to the root 
cause. [ISQM 1, 42] 


Remedial actions may include bringing in an auditor's expert or enhancing the 
nature, timing and extent of direction, supervision and review where deficiencies 
have been identified. If a deficiency does not affect the quality of the audit (e.g. 
if a technological resource that was available was not used) no further action is 
required. [ISA 220 (Revised), A111] 


However, even if a deficiency is identified, it does not necessarily mean that 
audit quality has been affected or that the report issued was inappropriate. 


Annual evaluation of the firm’s quality management system is required to be 
undertaken. [ISQM 1, 9] 
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Post-issuance reviews 


Purpose To assess whether the firm's policies and procedures 
were implemented during an engagement and to 
identify any deficiencies therein. 

When After the auditor's report has been signed. 

Which files A selection of completed audit files. 


Conducted by 


A dedicated compliance or quality department/a 
qualified external consultant/an independent partner. 


Matters considered 


Working papers should demonstrate that: 


. Sufficient appropriate evidence has been 
obtained. 


. All matters were resolved before issuing the 
auditor's report. 


All working papers should be: 
. On file 

. Completed 

. Signed as completed 


. Evidence as reviewed. 


Outcomes 


A report of the results will be provided to the partners 
of the firm highlighting deficiencies that require 
corrective action. Recommendations will be made 
including: 


. Communication of findings 

. Additional quality reviews 

. Training 

. Changes to the firm's policies and procedures 


. Disciplinary action. 


A Note: ISQMs are not examinable for this exam, however, awareness of 
engagement quality reviews and reviewers is useful in terms of ethical 
safeguards and quality management measures. Therefore, detailed 
knowledge is not required and the references above are included to 
enhance your overall understanding. 
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A post-issuance quality review is being performed for the audit of Button 
Co. During the review the following deficiencies have been identified: 


1 No briefing meeting was held at the planning stage for the audit 
team. Instead, the audit supervisor spoke to each team member 
individually to inform them of their role and responsibilities. 


2 The audit supervisor was unable to work for one week of the audit 
due to sickness. No replacement was arranged resulting in the 
audit juniors being unsupervised for this time. 


3 The audit team’s work was only reviewed by the audit manager 
three days prior to the date the auditor's report was signed rather 
than being reviewed at regular intervals during the audit. 


The first deficiency means the audit has not been performed as 
efficiently as it could have been as the audit supervisor could have 
briefed the whole team in one meeting rather than speaking to each 
person individually. Assuming each person received the relevant 
information, this will not have impacted audit quality. 


The second deficiency potentially has more severe consequences 
depending on the complexity of the audit and the experience of the audit 
juniors. If the audit was complex and/or the audit juniors relatively 
inexperienced, if issues were identified, there was no-one for them to 
raise concerns with and no-one keeping track of the competence of the 
team or tracking the progress of the audit. This could have caused 
problems with audit quality. However, if the audit was straightforward 
with no issues being encountered and the audit juniors were able to 
carry out their work without the need to ask for help, there may have 
been no quality issues. 


The third deficiency potentially has severe consequences, particularly 
when coupled with the lack of supervision. If the review of work identified 
that further work needed to be performed, the fact that the review took 
place so late in the audit process could have meant not enough time 
was available to do this additional work. This could have meant sufficient 
and appropriate evidence was not obtained. However, if the audit was 
straightforward and no further work was required to be performed, audit 
quality will not have been affected. 


The key message is that without quality management processes in 
place, audits may not be performed to the required standard. 


In respect of the above, the deficiencies need to be remediated by 
communicating the need for appropriate direction, supervision and 
review with managers and partners. Additional quality reviews should be 
performed to ensure this feedback is being actioned. 
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8 Audit documentation 


AUDIT DOCUMENTATION 


Purposes Contents Custody and retention 


Purposes of audit documentation 


ISA 230 Audit Documentation requires auditors to prepare and retain written 
documentation that: 


. Provides evidence of the auditor's basis for their report. 


. Provides evidence that the audit was planned and performed in 
accordance with ISAs and applicable legal and regulatory requirements. 


[ISA 230, 2] 
In addition, audit documentation: 
. Assists the engagement team to plan and perform the audit. 


. Assists members of the engagement team responsible for supervision to 
direct, supervise and review the audit work. 


. Enables the engagement team to be accountable for its work. 
. Retains a record of matters of continuing significance to future audits. 


. Enables engagement quality reviews and monitoring activities under the 
firm’s system of quality management to be performed. 


. Enables the external quality inspections to be performed. 
[ISA 230, 3] 


Form and content of audit documentation 


Documentation should be sufficient to enable an experienced auditor, with no 
previous connection to the audit, to understand: 


. The nature, timing and extent of audit procedures performed. 
. The results of the procedures performed and the evidence obtained. 


. The significant matters arising during the course of the audit and the 
conclusions reached thereon, and significant professional judgements 
made in reaching those conclusions. 


[ISA 230, 8] 
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Retention of working papers 


Documentation is retained in an audit file, which should be completed in a 
timely fashion after the date of the auditor's report (normally not more than 
60 days after) and retained for the period required by national regulatory 
requirements (this is normally five years from the date of the auditor's report). 


[ISA 230, A21, A23] 


Fy 


Client: 
Period end: 


Subject 


Objective: 


Work 
performed: 


Results: 
Conclusions: 


Reviewed by: 


Waag Cs 
S112(X4 


Risk Assessment 


Date reviewed: 


RA 
Rob Cash 
Date prepared: Dee / ZOKA 


Reference: 


Prepared by: 


To identify the risks of material misstatement in the 
financial statements of Murray Co for the year 
ended 31 December 20X4, in order to provide a 
basis for designing and performing audit procedures 
that respond to the assessed risks. 


Discussion among the engagement team of the 
susceptibility of the financial statements to material 
misstatement: RA1/1of the financial statements to 
material misstatement: RA1/1 


Asummary of the understanding of the entity and its 
environment obtained, detailing the key elements 
including internal control components, sources of 
information and risk assessment procedures 
performed: RA/2 

Analytical procedures performed: RA/3 

The identified and assessed risks of material 
misstatement: RA/4 

The overall responses to address the risks of 
material misstatement: RA/S 


Au Audit Manager 
December 5 2014 
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Wimble & Co working paper 


Features of Wimble & Co working paper 
Name of client: identifies the client being audited. 
Period-end date: identifies the period to which the audit work relates. 


Subject: identifies the topic of the working paper such as the area of the 
financial statements being audited, or the overall purpose of the work. 


Working paper reference: provides a clear reference to identify the 
working paper. RA‘1 is the first working paper in the risk assessment 
section. 


Preparer: identifies the name of the audit team member who prepared 
the working paper to enable any queries to be directed to the relevant 
person. 


Date prepared: the date the audit work was performed, the end of the 
time period to which issues were considered. 


Objective: this explains the relevance of the work being performed 
(in relation to financial statement assertions where appropriate). 


Work performed: the work done cross-referenced to supporting 
working papers, including details of the sources of information, and 
items selected for testing (where relevant). 


Results of work performed: any significant issues identified, 
exceptions or other significant observations including whether further 
audit work is necessary. 


Conclusions: key points (including whether the area is true and fair 
where relevant). 


Reviewer: the name of the audit team member who reviewed the work. 
This provides evidence of the review as required by ISA 220 (Revised). 


Date of review: this must be before the audit opinion is signed. 
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Audit documentation includes: 
. Planning documentation 
— overall audit strategy 
— audit plan 
. Audit programmes 
. Summary of significant matters 
. Written representation from management 
. Checklists 
. Correspondence 


. Copies of client records. 


For large audits, much of the knowledge of the business information 
may be kept on a permanent file and the audit plan may contain a 
summary or simply cross reference to the permanent file. Typical 
information on a permanent file includes: 


. Names of management, those charged with governance, 
shareholders 


. Systems information 

. Background to the industry and the client’s business 
. Title deeds 

. Directors’ service agreements 


. Copies of contract and agreements. 


The audit work for a specific period is kept on a current file. 


Typically, there are at least three sections: 
. Planning 
. Performance 


. Completion. 
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Planning 


The main element of this section is likely to be the Audit Planning 
Memorandum. 


This document is the written audit plan and will be read by all members 
of the audit team before work starts. Its contents are likely to include: 


Background information about the client, including recent 
performance 


Changes since last year’s audit (for recurring clients) 
Key accounting policies 

Important laws and regulations affecting the company 
Trial balance (or draft financial statements) 
Preliminary analytical procedures 

Key audit risks 

Overall audit strategy 

Materiality assessment 

Timetable of procedures 

Deadlines 

Staffing and a budget (hours to be worked x charge out rates) 


Locations to be visited. 


Performance 


Working papers are likely to consist of: 


Lead schedule — showing total figures, which agree to the financial 
statements. 


Back-up schedules — breakdowns of totals into relevant sub-totals. 
Audit work programme detailing: 

— The objectives being tested 

— Work completed 

- How samples were selected 

- Conclusions drawn 

— Who did the work 

- Date the work was completed 

- By whom it was reviewed. 
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Completion 


The completion (also known as review) stage of an audit has a number 
of standard components: 


. Going concern review 

. Subsequent events review 

. Final analytical procedures 

. Accounting standards (disclosure) checklist 

. Written representation from management 

. Summary of adjustments made since trial balance produced 
. Summary of unadjusted misstatements 

. Draft final financial statements 


. Draft report to those charged with governance and management 
letter. 


RA Security of working papers 


AVOID IT 
EXPENSIVE CONFIDENTIALITY TAMPERING IMPLICATIONS 


Who owns the working papers? 


The auditor owns the audit working papers. This is important because: 


. Access to the working papers is controlled by the auditor, not the 
client, which is an element in preserving the auditor's 
independence. 


. In some circumstances care may need to be taken when copies of 
client generated schedules are incorporated into the file. 
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Security 


Working papers must be kept secure. 


. By its nature, audit evidence will comprise confidential, sensitive 
information. If the files are lost or stolen, the auditor’s duty of 
confidentiality will be compromised. 


. Audits are expe! 


nsive. If the files are lost or stolen, the evidence 


they contain will need to be recreated, so the work will need to be 
done again. The auditors may be able to recover the costs from 
their insurers, but otherwise it will simply represent a loss to the 


firm. 


. There have beel 
working papers 


n cases of unscrupulous clients altering auditors’ 
o conceal frauds. 


The implications of IT-based audit systems are also far reaching. 


. By their nature, 


aptops are susceptible to theft, even though the 


thief may have no interest in the contents of the audit file. 


Nevertheless, al 


I the problems associated with re-performing the 


audit and breaches of confidentiality remain. 


. t is more difficu 
based files than 


iles have been 


t to be certain who created or amended computer 
manual files — handwriting, signatures and dates 


have their uses — and this makes it harder to detect whether the 


tampered with. 


This means that the following precautions need to be taken. 


. f files are left unattended at clients’ premises — overnight or during 


unch breaks — tl 


hey should be securely locked away, or if this is 


not possible, taken home by the audit team. 


. When files are left in a car, the same precautions should be taken 


as with any valu: 


ables. 


. T-based systems should be subject to passwords, encryption and 
back up procedures. 
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Test your understanding 1 


It is 1 July 20X5. You have recently been assigned as audit senior for 
the audit of Rock Co for the year ending 31 August 20X5. Your firm has 
audited this company for a number of years but this is the first year you 
will have worked on this audit. 


Rock Co is a company listed on a stock exchange. Rock Co is engaged 
in the wholesale import, manufacture and distribution of basic cosmetics 
and toiletries for sale to a wide range of stores, under a variety of 
different brand names. 


Required: 


(a) Describe the procedures you will perform in order to obtain an 
understanding of Rock Co. 


(10 marks) 


(b) You are now nearing the completion of the audit of Rock Co. You 
have been asked to perform a review of the audit file before it is 
passed to the audit manager and the audit engagement partner for 
their review. You have been asked to concentrate on the proper 
completion of the audit working papers. Some of the audit working 
papers have been produced electronically but all of them have 
been printed out for you. 


Required: 


Describe the types of audit working papers you should expect to 
see in the audit file and the features of those working papers that 
show that they have been properly completed. 


(10 marks) 
(Total: 20 marks) 
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Test your understanding 2 


You are the audit manager responsible for planning the audit of Rottnest 
Co. During the planning of the audit you have identified an increased 
risk of material misstatement due to fraud. The audit strategy and audit 
plan reflect this increased risk. 


1 Which of the following statements regarding fraud is TRUE? 


A 


(03 


D 


The auditor may not detect all material fraud in the financial 
statements but this won't necessarily mean the auditor has 
been negligent due to the nature of fraud and the likelihood of 
concealment 


The auditor must detect all material fraud in the financial 
statements 


The auditor must detect every fraud in the financial 
statements 


The auditor is not responsible for detecting fraud as this is 
management's responsibility 


2 If material misstatement as a result of fraud is detected during 
the audit, and is not corrected by management, how will this 
be communicated to the shareholders? 


A 


B 


Cc 


D 


The auditor must send a letter to the shareholders informing 
them of the fraud 


The auditor must speak at the annual general meeting and 
specifically inform them 


The auditor will report it to the police and the police will notify 
the shareholders 


Through the auditor's report as the opinion will be modified 


3 Which of the following procedures must the auditor perform 
to respond to the risk of fraud? 


(i) 


The auditor must obtain written representation from 
management confirming they have disclosed all known and 
suspected frauds to the auditor. 


The auditor must incorporate an unpredictable element into 
the design of their audit procedures. 


The auditor must test year-end journal entries and estimates 
which may be used to manipulate the financial statements. 


(i) and (ii) only 
(i) and (iii) only 
(ii) and (iii) only 
(i), (ii) and (iii) 
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4 Which of the following statements is TRUE in respect of the 
audit plan? 


A The audit plan sets out the scope, direction and framework 
for the audit 


B The audit plan contains the detailed audit procedures 
designed to obtain sufficient appropriate evidence including 
the objective of each procedure and the sample size to be 
tested 


C The plan includes preliminary engagement activities such as 
materiality and risk assessment 


D The audit plan is developed before the audit strategy 

5 Which matters will NOT be included in the audit strategy? 
A Risk assessment and materiality 
B Communications with the client 
C Specific audit procedures to respond to the risks assessed 
D The need for professional scepticism 


Test your understanding 3 


Your firm has recently been appointed auditor of Albany Co, a large 
company with sophisticated computer systems. The planning is due to 
commence shortly. It has been agreed with the client that an interim and 
final audit will be performed. 


1 Which of the following is NOT a benefit of planning the audit? 
A __ lt ensures the audit is performed efficiently and effectively 
B __ It helps identify the resources to be allocated 
C __ It ensures the financial statements will be correct 
D It minimises the risk of issuing an inappropriate audit opinion 


2 Which of the following is NOT part of the planning stage of the 
audit? 


A Preliminary materiality assessment 
B Risk assessment 

C Developing the audit strategy 

D Final analytical procedures 
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Which of the following is the most appropriate time to perform 
an interim audit? 


A After the year end before the auditor's report is signed 
B Before the year end 

C Atthe same time as the final audit 

D After the auditor's report has been signed 


Which of the following will NOT be performed at the interim 
audit? 


A Obtaining written representation from management 
B Tests of controls 


C Transaction testing for transactions that have occurred to 
date 


D Performing risk assessment procedures 

What are the main reasons for performing an interim audit? 
(i) To increase fee income for the firm. 

(ii) To reduce time pressure at the final audit. 


(iii) To assess the level of control risk and determine the amount 
of substantive testing required at the final audit. 


(i) and (ii) only 
(i) and (iii) only 
(ii) and (iii) only 
(i), (ii) and (iii) 


DO WD > 
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Test your understanding 4 


It is 1 July 20X5. Tasmania & Co is a firm of chartered certified 
accountants offering a range of audit and other assurance 
engagements. 


The firm has recently been appointed auditor of Fraser Co which has 
been assessed as a high risk engagement. Planning of the audit for the 
year ending 30 September 20X5 is due to commence next week with a 
planning meeting with the client to obtain an understanding of the 
business and its performance during the year to date, followed by a 
meeting of the audit team members. 


As it is a high risk engagement, an engagement quality review will need 
o be performed and a reviewer has yet to be assigned. The firm has six 
partners. Detail of their partner level experience and current utilisation is 
shown below. 


Partner level experience | Utilisation rate 
JK Less than 1 year 75% 
LM 6 years 80% 
NO 10 years 75% 
PQ 12 years 100% 
RS 15 years 100% 
YZ 20 years 95% 


Additional information: 


LM has been assigned as the audit engagement partner for Fraser Co. 
YZ is due to move to a part time role from 1 October 20X5. 


1 Which of the following is NOT one of the eight categories of a 
quality management system as per ISA 220 (Revised)? 


A Engagement resources 

B Engagement performance 
C Engagement quality review 
D Monitoring and remediation 


2 Which of the following are primary reasons why a firm should 
perform audits to a high standard of quality? 


(i) To maintain confidence in the audit profession. 
(ii) To ensure auditor's reports issued are appropriate. 
(iii) To avoid punishment. 


(iv) To ensure clients receive a competent and professional 
service. 
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A (i)and (ii) 

B (i), (ii) and (iv) 
C (iii) and (iv) 

D (i), (ii) and (iv) 


The planning meeting of audit team members is an example of 
which element of quality management? 


A Direction 

B Consultation 
C Review 

D Supervision 


Which partner should be assigned as the Engagement Quality 
Reviewer? 


A JK 
B NO 
C PQorRS 
D YZ 


Which of the following statements regarding quality 
management is FALSE? 


A Where deficiencies in quality management procedures are 
identified the firm should take action such as providing 
additional training or increasing the frequency of quality 
reviews. 


B The firm only needs to act on deficiencies identified by an 
external quality review such as that performed by the ACCA. 


C The firm should monitor its quality management procedures 
and policies at least annually. 


D Every person within the audit firm has a responsibility to 
ensure quality management is adhered to. 


KAPLAN PUBLISHING 


Pi 


Chapter 6 
9 Chapter summary 
= 
Purpose Audit strategy Audie plan 
e Enables an efficient & e Characteristics Procedures to be 
effective audit e Significant factors performed 
e Resolve matters in a & preliminary ae e Team member assigned 
timely way engagement activities e Sample sizes 


Interim audit 


Selection of team 


Work performed 

before year end 
Reduces pressure 

on final audit 

Controls testing & 
substantive procedures 


Documentation 
Experienced auditor test 


© Reporting objectives 
Resources 


Quality management 
Ethical requirements 


Timing of the work 


owe & regulations 


Responsibilities 
Procedures to identify 
non-compliance 
Procedures to assess 
impact of non- 
compliance 
Reporting 


Fraud 


Responsibilities 
Risk assessment 


e Permanent file * Engagement resources © e A 
e Current file © Engagement e Responding to fraud risk 
e Custody and retention performance e Reporting 
e Monitoring & 
remediation 
Ne 
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Test your understanding 1 


(a) Procedures to obtain an understanding of Rock Co 


Review prior year working papers, and speak with the audit 
manager responsible for the prior year audit, to obtain an 
understanding of the client and to establish any matters that 
require attention in the current year. 


Enquire of Rock Co’s management if there have been any 
significant changes to the business or issues arising during 
he year such as major customers or suppliers being lost or 
won. 


Enquire how management responds to the risk of fraud within 
he company and whether any frauds have been identified 
during the year. 


Enquire of management whether there has been any change 
in the financing of the company during the year e.g. new 
loans taken out or new shares issued. 


Review press reports/perform an internet search to identify 
any media coverage relating to the client. 


Review industry journals for information about the 
performance of the industry which can be used to compare 
with the client's performance and help identify unusual trends. 


Review management accounts, financial information provided 
o the stock exchange or draft financial statements that may 
be available to establish trends in the business. 


Perform analytical procedures to establish areas that indicate 
potential material misstatement and require attention during 
he audit. 


Review systems documentation (either generated by Rock 
Co or held by the firm) to identify changes in controls. 


Perform a walkthrough test to confirm understanding of how 
he internal controls operate. 


Review stock exchange requirements to identify any changes 
during the year. 


Review industry journals/correspondence with regulatory 
bodies to obtain an understanding of the legal and regulatory 
ramework the company operates within. 
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(b) 


Types and features of audit working papers 


Types of audit working papers include: 


Systems documentation (flowcharts, systems manuals, 
narrative notes, checklists and questionnaires, etc.) 


Constitutional documents 
Agreements with banks and other providers of finance 
Details of other advisors used by the entity such as lawyers 


Regulatory documentation relating to the stock exchange 
listing 


Audit planning documentation 
Audit work programs 
Working papers showing the work performed 


External confirmations from third parties such as the bank 
and customers confirming balances at the year end 


Lead schedules showing summaries of work performed and 
conclusions on individual account areas and the amounts to 
be included in the financial statements 


Trial balance, management accounts and financial 
statements 


Schedule of unadjusted differences 
Schedule of review points 
Report to management 


Written representation letter. 


Features of audit working papers 


All working papers should show the name of the preparer and 
the date prepared, and the name of the reviewer and the date 
reviewed, by means of signatures and dates. These may be 
electronic in the case of electronic working papers. 


Audit planning documentation should include the risk 
assessment cross-referenced to the audit program, and the 
audit program should cross-reference to the audit working 
papers. 


Working papers showing the work performed should be 
cross-referenced to the audit program and the lead schedule 
on that particular section of the audit file, and should describe 
the nature of the work performed, the evidence obtained, and 
the conclusions reached. 
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Each section of the audit file should have a lead schedule 
cross-referenced to the relevant working papers. 


The trial balance should be cross-referenced to the relevant 
sections of the audit file where the audit work is documented, 
and to the financial statements. 


The schedule of unadjusted differences should be cross- 
referenced to the sections of the file to which they relate. 


A schedule of review points should be ‘cleared’ to show that 


all ou 


standing matters have been dealt with. 


Test your understanding 2 


4 


A 


The auditor should plan and perform the audit to have 
a reasonable expectation of detecting material fraud 
and error. However, if a fraud is very well concealed, 
even a very thorough audit may not detect it. 


Material misstatements are brought to the attention of 
the shareholders by modifying the audit opinion. 


All three procedures must be performed to respond to 
the risk of fraud. 


Options A and C describe aspects of the audit 
strategy The audit strategy is developed before the 
audit plan. 


Specific procedures are included in the audit plan. 
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qj Test your understanding 3 


4 


Cc 


Financial statements cannot be verified as being 
correct due to the inclusion of estimates and 
judgements. 


‘Final’ analytical procedures are performed at the 
completion stage of the audit. 


The interim audit helps to develop the audit strategy. 
It should take place before the year end to avoid 
interfering with the client's year-end procedures but 
should not be so early that it is of little use. 


Written representations are obtained at the end of 
the audit, just before the auditor's report is signed. 


An interim audit may result in increased fees for the 
firm if a greater amount of work is performed, 
however, this is not a reason for performing an 
interim audit. The interim audit is a means of 
spreading the workload over a longer period to avoid 
time pressure. 
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Test your understanding 4 


1 


Cc 


Engagement quality review is part of engagement 
performance. 


D 


Quality is important for upholding the reputation of 
the profession and the firm in order to maintain 
investor confidence. Avoiding punishment is not the 
primary reason for ensuring a quality audit is 
performed. 


Briefing of the audit teams forms part of the direction 
of the audit. 


An EQR should be performed by someone 
independent of the engagement team and someone 
who is capable and competent. NO is the only 
partner who meets these requirements. 


JK has limited experience at partner level therefore 
is unlikely to have sufficient competence at this time 
to be the engagement quality reviewer. 


PQ and RS are both experienced but are already 
fully utilised and the reviewer must be able to devote 
sufficient time to the role, therefore would not be 
appropriate. 


YZ is experienced and has some spare capacity but 
is due to move to a part time role and is therefore 
unlikely to have sufficient time available to perform 
the quality review given the current utilisation rate of 
95%. 


The firm should perform its own quality reviews and 
take remedial action as necessary to ensure quality 
management procedures are followed. 


KAPLAN PUBLISHING 


Chapter 


7 


KAPLAN PUBLISHING 


Evidence 


Chapter learning objectives 


This chapter covers syllabus areas: 


C1a — The need to obtain an understanding of internal 
control relevant to the audit 


D1 — Assertions and audit evidence 

D2 — Audit procedures 

D3 — Audit sampling and other means of testing 
D5 — Automated tools and techniques 


D6 — The work of others 


Detailed syllabus objectives are provided in the introduction 
section of the text book. 


One of the PER performance objectives 
(PO19) is to collect and evaluate evidence for 
an audit. Carry out an internal or external audit 
from collecting evidence, through to forming an 


opinion. You demonstrate professional 
scepticism and make sure judgements are 
based on sufficient valid evidence. Working 
through this chapter should help you 
understand how to demonstrate that objective. 
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= a 


—— 
Audit evidence 
\——________# 


Automated tools 
and techniques 


Selecting items 
for testing 


Using the 
work of others 


1 Audit evidence 
ISA 500 Audit Evidence states the objective of the auditor, in terms of 
gathering evidence, is: 


‘to design and perform audit procedures in such a way to enable the 
auditor to obtain sufficient appropriate audit evidence to be able to 
draw reasonable conclusions on which to base the auditor's opinion.’ 
[ISA 500, 4] 


. Sufficiency relates to the quantity of evidence. 


. Appropriateness relates to the quality or relevance and reliability of 
evidence. 


[ISA 500, 5b, 5e] 


The auditor needs to gather ‘enough’ evidence to form a conclusion. This is a 
matter of professional judgement. When determining whether there is enough 
evidence the auditor must consider: 


. The risk of material misstatement 

. The materiality of the item 

. The nature of accounting and internal control systems 

. The results of controls tests 

. The auditor's knowledge and experience of the business 
. The size of a population being tested 

. The size of the sample selected to test 


. The reliability of the evidence obtained. 


KAPLAN PUBLISHING 


Chapter 7 


Consider the audit of a bank balance: 


The auditor will confirm year-end bank balances directly with the bank. 
This is a good source of evidence but on its own is not sufficient to give 
assurance regarding the completeness and final valuation of bank and 
cash amounts. The key reason is timing differences. The client may 
have received cash amounts or cheques before the end of the year, or 
may have paid out cheques before the end of the year, that have not yet 
cleared the bank account. For this reason, the auditor should also 
review and reperform the client's year-end bank reconciliation. In 
combination, these two pieces of evidence will be sufficient to give 
assurance over the bank balances. 


Appropriateness of evidence breaks down into two important concepts: 
Reliability 


Relevance. 


Reliability 


The auditor should always attempt to obtain evidence from the most trustworthy 
and dependable source possible. 


Evidence obtained from an independent external source is more reliable 
than client generated evidence. 


Evidence obtained directly by the auditor is more reliable than evidence 
obtained indirectly. 


Client generated evidence is the least reliable source of evidence. If the 
client is manipulating the financial statement figures they may produce 
fictitious evidence to support the figures. Client generated evidence is 
more reliable if effective controls are in place. This doesn't mean the 
auditor should not rely on client generated evidence. It simply means that 
where more reliable evidence is available, the auditor should obtain it. 


In addition, written evidence is more reliable than oral evidence as oral 
representations can be withdrawn or challenged. Original documents are 
more reliable than copies or documents transformed into electronic form 
as it may be difficult to see if these have been tampered with. 


[ISA 500, A31] 
Broadly speaking, the more reliable the evidence the less of it the auditor will 


need 
audit, 


. However, if evidence is unreliable it will never be appropriate for the 
, no matter how much is gathered. [ISA 500, A4] 


KAPLAN PUBLISHING 


199 


Evidence 


Relevance 


Relevance means the evidence relates to the financial statement assertions 
being tested. [ISA 500, A27] 


For example, when attending an inventory count, the auditor will: 


. Select a sample of items from physical inventory and trace them to 
inventory records to confirm the completeness of accounting records 


. Select a sample of items from inventory records and trace them to 
physical inventories to confirm the existence of inventory assets. 


Whilst the procedures are similar in nature, their purpose (and relevance) is to 
test different assertions regarding inventory balances. 


2 Financial statements assertions 


The objective of audit testing is to assist the auditor to reach a conclusion as to 
whether the financial statements are free from material misstatement. 


The auditor will perform a range of tests on the significant classes of 
transactions and account balances. These tests focus on the financial 
statement assertions. 


Assertions: ‘Representations, explicit or otherwise, with respect to 
the recognition, measurement, presentation and disclosure of 
information in the financial statements which are inherent in 
management representing that the financial statements are prepared 
in accordance with the applicable financial reporting framework. 


Assertions are used by the auditor to consider the different types of 
potential misstatements that may occur when identifying, assessing 
and responding to the risks of material misstatement.’ 


[ISA 315 (Revised 2019), 12a] 


a Nei >) 
TRANSACTIONS ACCOUNT 
& EVENTS BALANCES 
N N 
——— — 
1 OCCURRENCE 1 EXISTENCE 
2 COMPLETENESS 2 RIGHTS & 
3 ACCURACY OBLIGATIONS 
4, CUT-OFF 3 COMPLETENESS 
5 CLASSIFICATION 4 ACCURACY, 
6 PRESENTATION VALUATION AND 
SSS ALLOCATION 
5 CLASSIFICATION 
6 PRESENTATION 
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Assertions about classes of transactions and events, and related 
disclosures, for the period under audit 


Occurrence - the transactions and events recorded and disclosed have 
occurred and pertain to the entity. 


Completeness — all transactions and events that should have been recorded 
have been recorded, and all related disclosures that should have been included 
have been included. 


Accuracy — amounts and other data have been recorded appropriately and 
related disclosures have been appropriately measured and described. 


Cut-off — transactions and events have been recorded in the correct accounting 
period. 


Classification — transactions and events have been recorded in the proper 
accounts. 


Presentation — transactions and events are appropriately aggregated or 
disaggregated and clearly described, and related disclosures are relevant and 
understandable in the context of the applicable financial reporting framework. 


[ISA 315 (Revised 2019), A190a] 


Assertions about account balances and related disclosures at the period 
end 


Existence — assets, liabilities and equity interests exist. 


Rights and obligations — the entity holds or controls the rights to assets and 
liabilities are the obligations of the entity. 


Completeness - all assets, liabilities and equity interests that should have 
been recorded have been recorded, and all related disclosures that should have 
been included have been included. 


Accuracy, valuation and allocation — assets, liabilities and equity interests 
have been included in the financial statements at appropriate amounts and any 
resulting valuation or allocation adjustments have been appropriately recorded, 
and related disclosures have been appropriately measured and described. 


Classification — assets, liabilities and equity interests have been recorded in 
the proper accounts. 

Presentation — account balances are appropriately aggregated or 
disaggregated and clearly described, and related disclosures are relevant and 
understandable in the context of the applicable financial reporting framework. 


[ISA 315 (Revised 2019), A190b] 
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There are many ways inventory could be materially misstated: 


. Items might not be counted and therefore not be included in the 
balance. This would mean the inventory balance was not 
complete. 


. Items delivered after the year end could be included in this 
accounting period. This would mean the inventory did not exist at 
the year-end date. 


. Damaged or obsolete inventory might not be valued appropriately 
at the lower of cost and net realisable value. 


. Purchase costs might not be recorded accurately. This would also 
affect valuation. 


. Inventory stored at the client's site may belong to a 3rd party. The 
client would not have the right to include this inventory in their 
financial statements. 


Addressing disclosures in the audit of financial statements 


Disclosures are an important part of the financial statements and seen 
as a way for communicating further information to users. Poor quality 
disclosures may obscure understanding of important matters. 


Concerns have been raised about whether auditors are giving sufficient 
attention to disclosures during the audit. The IAASB believes that 
where the term financial statements is used in the ISAs, it should be 
clarified that this is intended to include all disclosures subject to audit. 


Recent changes to ISAs include: 


. Emphasis on the importance of giving appropriate attention to 
addressing disclosures. 


. Focus on matters relating to disclosures to be discussed with 
those charged with governance, particularly at the planning stage. 


. Emphasis on the need to agree with management their 
responsibility to make available information relevant to 


disclosures, early in the audit process. 
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3 Sources of audit evidence 


Tests of Detail }-+-#-- Analytical 
Procedures 


Auditors can obtain assurance from: 


LO} Tests of control: Audit procedures ‘designed to evaluate the operating 
effectiveness of controls in preventing, or detecting and correcting 
material misstatement’. 


Substantive procedures: Audit procedures ‘designed to detect material 
misstatements at the assertion level’. 


[ISA 330, 4] 


Tests of controls 


In order to design further audit procedures, the auditor must assess the risk of 
material misstatement in the financial statements. 
A Remember: Audit risk = Inherent risk x Control risk x Detection risk 


Internal controls are a vital component of this risk model, they are the 
mechanisms that clients design in an attempt to prevent, detect and correct 
misstatement. This is not only necessary for good financial reporting, it is 
necessary to safeguard the assets of the shareholders and is a requirement of 
corporate governance. 


a The stronger the control system, the lower the control risk. This reduces 
he risk of material misstatement in the financial statements. 


In order to be able to rely on controls the auditor will need to: 

. Ascertain how the system operates 

. Document the system in audit working papers 

. Assess the design and operating effectiveness of the control system 
. Test the operation of the system 


. Determine the impact on the audit approach for specific classes of 
ransactions, account balances and disclosures. 
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The focus of a test of control is not the monetary amount of a transaction. A test 
of control provides evidence of whether a control procedure has operated 
effectively. For example, inspecting an invoice for evidence of authorisation. It is 
irrelevant whether the invoice is for $100 or $1000 as it the control being tested, 
not the amount. Therefore, it could be said that a test of control provides indirect 
evidence over the financial statements. The auditor makes the assumption that 
if controls are working effectively there is less risk of material misstatement in 
the financial statements. However, the test of control itself does not test the 
figure within the financial statements, this is the purpose of a substantive 
procedure. 


We will learn more about the systems themselves and tests of controls in the 
chapter ‘Systems and controls’. 


Substantive procedures 


Substantive procedures consist of: 
. Tests of detail: to verify individual transactions and balances. 


. Substantive analytical procedures: involve analysing relationships 
between information to identify unusual fluctuations which may indicate 
possible misstatement. 


am| | Tests of detail v analytical procedures 


A test of detail looks at the supporting evidence for an individual 
transaction such as inspection of a purchase invoice to verify the 
amount/date/classification of a specific purchase. If there are 5000 
purchase invoices recorded during the accounting period, this one test 
of detail has only provided evidence for one of those transactions. 


An analytical procedure would be used to assess the reasonableness of 
the purchases figure in total. For example, calculating the percentage 
change in purchases from last year and comparing this with the 
percentage change in revenue to see if they move in line with each 
other as expected. 


The analytical procedure is not looking at the detail of any of the 
individual purchases but at the total figure. It is possible that there are a 
number of misstatements within the purchases population which would 
only be discovered by testing the detail as they may cancel each other 
out. An analytical procedure would not detect these misstatements. 


Because of this, analytical procedures should only be used as the main 
source of substantive evidence where the internal controls have been 
found to be reliable, as there is less chance of misstatements being 
present as the control system would have detected and corrected them. 
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In some circumstances the auditor may rely solely on substantive testing: 


. The auditor may choose to rely solely on substantive testing where it is 
considered to be a more efficient or more effective way of obtaining audit 
evidence, e.g. for smaller organisations. 


. The auditor may have to rely solely on substantive testing where the 
client's internal control system cannot be relied on. 


The auditor must always carry out substantive procedures on material 
items. [ISA 330 The Auditor's Response to Assessed Risks, 18]. 


The auditor is required to carry out the following substantive procedures: 
. Agreeing the financial statements to the underlying accounting records. 


. Examination of material journals and other adjustments made in preparing 
the financial statements. 


[ISA 330, 20] 


4 Types of audit procedure 

The auditor can adopt the following procedures to obtain audit evidence: 
. Inspection of records, documents or physical assets. 

. Observation of processes and procedures, e.g. inventory counts. 


. External confirmation obtained in the form of a direct written response to 
the auditor from a third party. 


. Recalculation to confirm the numerical accuracy of documents or records. 
. Reperformance by the auditor of procedures or controls. 

. Analytical procedures. 

. Enquiry of knowledgeable parties. 

[ISA 500, A14 — A22] 


In the chapter ‘Procedures’ we will look in detail at how these procedures are 
applied to specific items in the financial statements. 
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| Explanation of audit procedures 


Inspection of documents and records: examining records or 
documents, in paper or electronic form. 


. May give evidence of rights and obligations, e.g. title deeds. 


. May give evidence that a control is operating, e.g. invoices 
stamped as paid or authorised for payment by an appropriate 
signature. 


. May give evidence about cut-off, e.g. the dates on invoices, 
despatch notes, etc. 


. Confirms sales values and purchases costs. 
Inspection of tangible assets: physical examination of an asset. 
. To obtain evidence of existence of that asset. 


. May give evidence of valuation, e.g. evidence of damage 
indicating impairment of inventory or non-current assets. 


Observation: looking at a process or procedure being performed by 
others. 


. May provide evidence that a control is being operated, 
e.g. segregation of duties or a physical check. 


. Only provides evidence that the control was operating properly at 
the time of the observation. The auditor's presence may have had 
an influence on the operation of the control. 


. Observation of a one-off event, e.g. an inventory count, may give 
good evidence that the procedure was carried out effectively. 


Enquiry: seeking information from knowledgeable persons, both 
financial and non-financial, within the entity or outside. 


Whilst a major source of evidence, the results of enquiries will usually 
need to be corroborated in some way through other audit procedures. 
This is because responses generated by the audit client are considered 
to be of a low quality due to their inherent bias. 


The answers to enquiries may be corroborative evidence. In particular, 
they may be used to corroborate the results of analytical procedures. 


Written representations from management are part of overall enquiries. 
These involve obtaining written statements from management to 
confirm oral enquiries. These are considered further in the chapter 


'Completion and review'. 
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External confirmation: obtaining a direct response (usually written) 
from an external, third party. 


. Examples include: 
—  Circularisation of receivables 


—  Circularisation of payables where supplier statements are 
not available 


— Confirmation of bank balances in a bank letter 
— Confirmation of actual/potential penalties from legal advisers 
— Confirmation of inventories held by third parties. 


. May provide good evidence of existence of balances, 
e.g. receivables confirmation. 


. May not provide reliable evidence of valuation, e.g. customers 
may confirm receivable amounts but, ultimately, be unable to pay 
in the future. 


Recalculation: manually or electronically checking the arithmetical 
accuracy of documents, records, or the client's calculations, 
e.g. recalculation of the translation of a foreign currency transaction. 


Reperformance: the auditor's independent execution of procedures or 
controls that were originally performed as part of the entity's internal 
control system, e.g. reperformance of a bank reconciliation. 


Analytical procedures: analysis of plausible relationships between 
data. See below. 


Analytical procedures as substantive tests 


We have already seen analytical procedures used as a risk 
assessment procedure at the planning stage (preliminary analytical 
procedures). Later in the text we will see them performed at the 
completion stage of the audit. Here we consider their use as 
substantive procedures, i.e. procedures designed to detect material 
misstatement. 


Analytical procedures are used to identify trends and understand 
relationships between sets of data. This in itself will not detect 
misstatement but will identify possible areas of misstatement. As such, 
analytical procedures cannot be used in isolation and should be 
coupled with other, corroborative, forms of testing, such as enquiry of 
management. 


When performing analytical procedures, the auditor does not simply 
look at current figures in comparison to last year, they may consider 
other points of comparison, such as budgets and industry data. 
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Other techniques are also available, including: 
. Ratio analysis 
. Trend analysis 


. Proof in total, for example: an auditor can create an expectation of 
payroll costs for the year by taking last year’s cost and inflating for 
pay rises and changes in staff numbers. 


Analytical procedures are useful for assessing several assertions at 
once as the auditor is effectively auditing a whole account balance or 
class of transaction to see if it is reasonable. 


They can be used to corroborate other audit evidence obtained, such 
as statements by management about changes in cost structures. 


By using analytical procedures, the auditor may identify unusual items 
that can then be further investigated to ensure that a misstatement 
doesn’t exist in the balance. 


However, in order to use analytical procedures effectively, the auditor 
needs to be able to create an expectation. It would be difficult to do this 
if operations changed significantly from the prior year. If the changes 
were planned, the auditor could use forecasts as a point of comparison, 
although these are inherently unreliable due to the number of estimates 
involved. In this situation it would be pointless comparing with past 
results as the business would be too different to be able to conduct 
effective comparison. 


It would also be difficult to use analytical procedures if a business had 
experienced a number of significant one-off events in the year as these 
would distort the figures making comparison to both prior year and 
budget meaningless. 

The suitability of analytical procedures as substantive tests 

To use analytical procedures, the auditor must: 

1 Develop an expectation 


2 Define the difference or threshold of variation which is considered 
acceptable 


3 Calculate the difference between the recorded amount and 
expected amount 


4 Investigate the differences which are greater than the acceptable 
level of variation established in step 2. 
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The suitability of this approach depends on four factors: 
. The assertion(s) under scrutiny 
. The reliability of the data 


. Whether the expectation developed by the auditor is sufficiently 
precise to identify a misstatement that may be material either 
individually or in aggregate 


. Whether the difference between the recorded amount and 
expected amount is acceptable. 


Assertions under scrutiny 


Analytical procedures should be suitable for the assertion being tested. 
They are clearly unsuitable for testing the existence of inventories. 
They are, however, suitable for assessing the value of inventory in 
terms of the need for allowances against old inventories, identified 
using the inventory holding period ratio. 


Analytical procedures are more suitable for testing balances which are 
likely to be predictable over time meaning relationships between data 
can be analysed to identify usual fluctuations e.g. the relationship 
between payroll cost and the number of employees. 


Reliability of data 


The source of the information will affect reliability as discussed earlier 
in the chapter. Reliability of comparable information is also an important 
factor. If controls over financial data are weak, the data is likely to 
contain misstatement and is therefore not suitable as a basis for 
assessment. 


Expectation developed by the auditor 


The auditor’s ability to develop an expectation will depend on the 
availability of reliable information. 


The auditor will be able to develop a more precise expectation if 
disaggregated information is obtained and analysed. For example, 
when performing analytical procedures over revenue, it may be more 
meaningful if sales by month/customer/product/region are analysed 
rather than the revenue figure as a whole. 


The difference between recorded amount and expected amount 


The amount of acceptable variation between the expected figure and 
the actual figure will impact whether analytical procedures provide 
sufficient appropriate evidence. If the level of variation from actual is 
higher than the level of variation the auditor is willing to accept, further 
procedures will be necessary to ensure the balance in the financial 
statements is not materially misstated. 
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5 Relying on the work of others 


——— 
Usingthe work of others 


—— 
os). 


Internal audit 
— 


Relyingon work already 
performed during the 
year 


Using internal audit to 
provide direct 
assistance to 

the external auditor 


* Valuers 
* Lawyers 
* Actuaries 


There are two types of expert an auditor may use: 


1 Management's expert — an employee of the client or someone engaged by 
the audit client who has expertise that is used to assist in the preparation 
of the financial statements. 


2 Auditor's expert — an employee of the audit firm or someone engaged by 
the audit firm to provide sufficient appropriate evidence. 


Relying on the work of a management's expert 


ISA 500 Audit Evidence provides guidance on what the auditor should consider 
before relying on the work of a management's expert. 


The auditor must: 
. Evaluate the competence, capabilities and objectivity of that expert. 
. Obtain an understanding of the work of that expert. 


. Evaluate the appropriateness of that expert's work as audit evidence for 
he relevant assertion. 


[ISA 500, 8] 


ea 


The auditor should ensure the expert management has chosen to use is 
competent to perform the work requested by the client. If the expert 
does not have relevant qualifications or experience, the work may not 
be reliable. 


The auditor should assess whether the expert management has chosen 
is objective. If the expert is a close relative of a director at the client 
company, the expert may produce a report containing information 
provided by the client rather than being the result of work they have 
performed. 
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Relying on the work of an auditor's expert 


ISA 620 Using the Work of an Auditor's Expert provides guidance to auditors. 


If the auditor lacks the required technical knowledge to gather sufficient 
appropriate evidence to form an opinion, they may have to rely on the work of 
an expert. 


Examples of such circumstances include: 


. The valuation of complex financial instruments, land and buildings, works 
of art, jewellery and intangible assets. 


. Actuarial calculations associated with insurance contracts or employee 
benefit plans. 


. The estimation of oil and gas reserves. 

. The interpretation of contracts, laws and regulations. 

. The analysis of complex or unusual tax compliance issues. 
[ISA 620, A1] 


The auditor must determine if the expert’s work is adequate for the auditor's 
purposes. [ISA 620, 5b] 


To fulfil this responsibility, the auditor must evaluate whether the expert has 
the necessary competence, capability and objectivity for the purpose of 
the audit. [ISA 620, 9] 


Evaluating competence [ISA 620, A15] 


Information regarding the competence, capability and objectivity on an expert 
may come from a variety of sources, including: 


. Personal experience of working with the expert. 
. Discussions with the expert. 
. Discussions with other auditors. 


. Knowledge of the expert's qualifications, memberships of professional 
bodies and licences. 


. Published papers or books written by the expert. 
. The audit firm's system of quality management. 
Evaluating objectivity [ISA 620, A20] 


Assessing the objectivity of the expert is particularly difficult, as they may not be 
bound by a similar code of ethics as the auditor and, as such, may be unaware 
of the ethical requirements and threats with which auditors are familiar. 
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It may therefore be relevant to: 


. Make enquiries of the client about known interests or relationships with the 
chosen expert. 


. Discuss applicable safeguards with the expert. 


. Discuss financial, business and personal interests in the client with the 
expert. 


. Obtain written representation from the expert. 
Agreeing the work [ISA 620, 11] 


Once the auditor has considered the above matters they must then obtain 
written agreement from the expert of the following: 


. The nature, scope and objectives of the expert’s work. 

. The roles and responsibilities of the auditor and the expert. 

. The nature, timing and extent of communication between the two parties. 
. The need for the expert to observe confidentiality. 

Evaluating the work [ISA 620, 12] 


Once the expert's work is complete the auditor must scrutinise it and evaluate 
whether it is appropriate for audit purposes. 


In particular, the auditor should consider: 

. The reasonableness of the findings and consistency with other evidence. 
. The significant assumptions made. 

. The use and accuracy of source data. 

Reference to the work of an expert 


The auditor cannot devolve responsibility for forming an audit opinion, they must 
use their professional judgement to assess whether the evidence produced by 
the expert is sufficient and appropriate to support the audit opinion. 


The use of an auditor's expert is not mentioned in an unmodified auditor's 
opinion unless required by law or regulation. Reference to the work of an expert 
may be included in a modified opinion if it is relevant to the understanding of the 
modification. This does not diminish the auditor's responsibility for the opinion. 
[ISA 620, 14 & 15] 
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Relying on internal audit 


ISA 610 Using the Work of Internal Auditors provides guidance. 


An internal audit department forms part of the client's system of internal control. 
If this is an effective element of the control system it may reduce control risk, 
and therefore reduce the need for the auditor to perform detailed substantive 
testing. 


Additionally, external auditors may be able to co-operate with a client's internal 
audit department and place reliance on their procedures in place of performing 
their own. 


Before relying on the work of internal audit, the external auditor must assess the 
effectiveness of the internal audit function and assess whether the work 
produced by the internal auditor is adequate for the purpose of the audit. 


Evaluating the internal audit function [ISA 610, 15] 


. The extent to which the internal audit function's organisational status 
and relevant policies and procedures support the objectivity of the 
internal auditors. 


. The competence of the internal audit function. 


. Whether the internal audit function applies a systematic and disciplined 
approach. 


Evaluating objectivity [ISA 610, A7] 


. Whether the internal audit function reports to those charged with 
governance or has direct access to those charged with governance. 


. Whether the internal audit function is free from operational responsibility. 


. Whether those charged with governance are responsible for employment 
decisions such as remuneration. 


. Whether any constraints are placed on the internal function by 
management or those charged with governance. 


. Whether the internal auditors are members of a professional body which 
requires compliance with ethical requirements. 


Evaluating competence [ISA 610, A8] 


. Whether the resources of the internal audit function are appropriate and 
adequate for the size of the organisation and nature of its operations. 


. Whether there are established policies for hiring, training and assigning 
internal auditors to internal audit engagements. 


. Whether internal auditors have adequate technical training and 
proficiency, including relevant professional qualifications and experience. 
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. Whether the internal auditors have the required knowledge of the entity's 
financial reporting and the applicable financial reporting framework and 
possess the necessary skills to perform work related to the financial 
statements. 


. Whether the internal auditors are members of a professional body which 
requires continued professional development. 


Evaluating the systematic and disciplined approach [ISA 610, A11] 
. Existence, adequacy and use of internal audit procedures and guidance. 
. Application of quality control policies and procedures. 


If the external auditor considers it appropriate to use the work of the internal 
auditors they then have to determine the areas and extent to which the work of 
the internal audit function can be used (by considering the nature and scope of 
work) and incorporate this into their planning to assess the impact on the 
nature, timing and extent of further audit procedures. [ISA 610, 17] 


Evaluating the internal audit work [ISA 610, 23] 


. The work was properly planned, performed, supervised, reviewed and 
documented. 


. Sufficient appropriate evidence has been obtained. 
. The conclusions reached are appropriate in the circumstances. 
. The reports prepared are consistent with the work performed. 


To evaluate the work adequately, the external auditor must reperform some of 
the procedures that the internal auditor has performed to ensure they reach the 
same conclusion. [ISA 610, 24] 


The extent of the work to be performed on the internal auditor's work will 
depend on the amount of judgement involved and the risk of material 
misstatement in that area. [ISA 610, 24] 


When reviewing and reperforming some of the work of the internal auditor, the 
external auditor must consider whether their initial expectation of using the work 
of the internal auditor is still valid. [ISA 610, 25] 


Note that the auditor is not required to rely on the work of internal audit. In some 
jurisdictions, the external auditor may be prohibited or restricted from using the 
work of the internal auditor by law. 


Responsibility for the auditor's opinion cannot be devolved and no reference 
should be made in the auditor's report regarding the use of others during the 
audit. 
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Using the internal audit to provide direct assistance 


External auditors can consider whether the internal auditor can provide direct 
assistance with gathering audit evidence under the supervision and review of 
the external auditor. ISA 610 provides guidance to aim to reduce the risk that 
the external auditor over uses the internal auditor. 


The following considerations will be made: 


. Direct assistance cannot be provided where laws and regulations prohibit 
such assistance, e.g. in the UK. [ISA 610, 26] 


. The competence and objectivity of the internal auditor. Where threats to 
objectivity are present, the significance of them and whether they can be 
managed to an acceptable level must be considered. [ISA 610, 27] 


. The external auditor must not assign work to the internal auditor which 
involves significant judgement, a high risk of material misstatement or with 
which the internal auditor has been involved. [ISA 610, 30] 


. The planned work must be communicated with those charged with 
governance so agreement can be made that the use of the internal auditor 
is not excessive. [ISA 610, 31] 


Where it is agreed that the internal auditor can provide direct assistance: 


. Management must agree in writing that the internal auditor can provide 
such assistance and that they will not intervene in that work. 
[ISA 610, 33a] 


. The internal auditors must provide written confirmation that they will keep 
the external auditors information confidential. [ISA 610, 33b] 


. The external auditor will provide direction, supervision and review of the 
internal auditor's work. [ISA 610, 34] 


. During the direction, supervision and review of the work, the external 
auditor should remain alert to the risk that the internal auditor is not 
objective or competent. [ISA 610, 35] 


Documentation [ISA 610, 37] 
The auditor should document: 
. The evaluation of the internal auditor's objectivity and competence. 


. The basis for the decision regarding the nature and extent of the work 
performed by the internal auditor. 


. The name of the reviewer and the extent of the review of the internal 
auditor's work. 


. The written agreement of management mentioned above. 


. The working papers produced by the internal auditor. 
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Use of service organisations 


Many companies use service organisations to perform business functions such 
as: 


. Payroll processing 
. Receivables collection 
. Pension management. 


If a company uses a service organisation, audit evidence will need to be 
obtained from the service organisation instead of, or in addition to, the client. 
This needs to be considered when planning the audit. 


ISA 402 Audit Considerations Relating to an Entity Using a Service 
Organisation provides guidance to auditors. 

Planning the audit 

The auditor will need to: 


. Obtain an understanding of the service organisation sufficient to identify 
and assess the risks of material misstatement. 


. Design and perform audit procedures responsive to those risks. 

[ISA 402, 1] 

This requires the auditor to obtain an understanding of the service provided: 
. Nature of the services and their effect on internal controls. 

. Nature and materiality of the transactions to the entity. 


. Level of interaction between the activities of the service organisation and 
the entity. 


. Nature of the relationship between the service organisation and the entity, 
including contractual terms. 


[ISA 402, 9] 


The auditor should determine the effect the use of a service organisation will 
have on their assessment of risk. The following issues should be considered: 


. Reputation of the service organisation. 

. Existence of external supervision. 

. Extent of controls operated by service provider. 
. Experience of errors and omissions. 


. Degree of monitoring by the user. 
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Sources of information about the service organisation 
. Obtaining a type 1 or type 2 report from the service organisation's auditor. 


A Type 1 report provides a description of the design of the controls at the 
service organisation prepared by the management of the service 
organisation. It includes a report by the service auditor providing an 
opinion on the description of the system and the suitability of the controls. 
[ISA 402, 8b] 


A Type 2 report is a report on the description, design and operating 
effectiveness of controls at the service organisation. It contains a report 
prepared by management of the service organisation. It includes a report 
by the service auditor providing an opinion on the description of the 
system, the suitability of the controls, the effectiveness of the controls and 
a description of the tests of controls performed by the auditor. [para 8c] 


If the auditor intends to use a report from a service auditor, they should 
consider: 


— The competence and independence of the service organisation 
auditor. 


— The standards under which the report was issued. 
. Contacting the service organisation through the client. 
. Visiting the service organisation. 


. Using another auditor to perform procedures that will provide the 
necessary information about controls at the service organisation. 


[ISA 402, 12] 


Responding to assessed risks 


The auditor should determine whether sufficient appropriate evidence is 
available from the client and if not, perform further procedures or use another 
auditor to perform procedures on their behalf. [ISA 402, 15] 


If controls are expected to operate effectively: 

. Obtain a type 2 report if available and consider: 
— Whether the date covered by the report is appropriate for the audit. 
— Whether the client has any complementary controls in place. 
— The time elapsed since the tests of controls were performed. 


— Whether the tests of controls performed by the auditor are relevant to 
the financial statement assertions. 


[ISA 402, 17] 
. Perform tests of controls at the service organisation. 
. Use another auditor to perform tests of controls. 
[ISA 402, 16] 
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The auditor should enquire of the client whether the service organisation has 
reported any frauds to them or whether they are aware of any frauds. 
[ISA 402, 19] 


Impact on the auditor's report 


If sufficient appropriate evidence has not been obtained, a qualified or 
disclaimer of opinion will be issued. [ISA 402, 20] 


The use of a service organisation auditor is not mentioned in the auditor's report 
unless required by law or regulation. Reference to the work of a service 
organisation auditor may be included in a report containing a modified opinion if 
it is relevant to the understanding of the modification. This does not diminish the 
auditor's responsibility for the opinion. [ISA 402, 21] 


Benefits to the audit 


. Independence: because the service organisation is external to the client, 
the audit evidence derived from it is regarded as being more reliable than 
evidence generated internally by the client. 


. Competence: because the service organisation is a specialist, it may be 
more competent in executing its role than the client's internal department 
resulting in fewer errors. 


. Possible reliance on the service organisation’s auditors: it may be possible 
for the audit firm to confirm information directly with the service 
organisation's auditors. 


Drawbacks 


The main disadvantage of outsourced services from the auditor's point of view 
concerns access to records and information. 


The auditor has a legal right to access the client's records and to receive 
answers and explanations that they consider necessary for the audit. They do 
not have such rights over records and information held by a third party such as 
a service organisation. 


If access to records and other information is denied by the service organisation, 
this may impose a limitation on the scope of the auditor's work. If sufficient 
appropriate evidence is not obtained, this will result in a modified audit opinion. 


6 Selecting items for testing 


The auditor has three options for selecting items to test: 


1 Select all items to test (100% testing) [ISA 500, A54] 


This approach may be taken where the population is very small and it is easy 
for the auditor to test all items. Alternatively, if it is an area over which the 
auditor requires greater audit confidence, for example an area that is material 
by nature or is considered to be of significant risk, the auditor may decide to test 
all items within the population. 
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2 Selecting specific items for testing [ISA 500, A55] 


Items with specific characteristics may be chosen for testing such as: 
. High value items within a population 

. All items over a certain amount 

. Items to obtain information. 


Although less than 100% of the population is being tested, this does not 
constitute sampling. As explained below, sampling requires all items in the 
population to have a chance of selection. In the categories above, only the 
items with the specific characteristics have a chance of selection. 


The definition of sampling, as described in ISA 530 Audit Sampling is: 


LO} ‘The application of audit procedures to less than 100% of items 
within a population of audit relevance such that all sampling units 
have a chance of selection in order to provide the auditor with a 
reasonable basis on which to draw conclusions about the entire 
population.’ [ISA 530, 5a] 


The need for sampling 


It will usually be impossible to test every item in an accounting population 
because of the costs involved. 


It is also important to remember that auditors give reasonable not absolute 
assurance and therefore do not certify that the financial statements are 100% 
accurate. 


Selecting an appropriate sample 
When sampling, the auditor must choose a representative sample. 


. If a sample is representative, the same conclusion will be drawn from that 
sample as would have been drawn had the whole population been tested. 


. For a sample to be representative, it must have the same characteristics 
as the other items in the population from which it was chosen. 
[ISA 530, A12] 


. In order to reduce sampling risk and ensure the sample is representative, 
the auditor can increase the size of the sample selected or use 
stratification. 


Stratification [ISA 530, Appendix 1] 


Stratification is used in conjunction with sampling. Stratification is the process of 
breaking down a population into smaller subpopulations. Each subpopulation is 
a group of items (sampling units) which have similar characteristics. 
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The objective of stratification is to enable the auditor to reduce the variability of 
items within the subpopulation and therefore allow sample sizes to be reduced 
without increasing sampling risk. 


For example, the auditor may stratify the population of revenue into three 
subpopulations: revenue from Product A, revenue from Product B and revenue 
from Product C. The auditor may select a sample of revenue from Product A. 
The results of the testing of that sample can be extrapolated across the whole 
subpopulation of revenue from Product A. A sample may be selected of 
revenue from Product B and again, the results of that testing can be 
extrapolated across that subpopulation. Revenue from Product C may not be 
tested if it is considered immaterial. 


Statistical and non-statistical sampling 


LO} Statistical sampling means any approach to sampling that uses: 
. Random selection of samples, and 
. Probability theory to evaluate sample results. 


Any approach that does not have both of these characteristics is considered to 
be non-statistical sampling. [ISA 530, 5g] 


The approach taken is a matter of auditor judgement. [ISA 530, A9] 
Statistical sampling methods [ISA 530, Appendix 4] 


. Random selection — this can be achieved through the use of a random 
number generator or table. 


. Systematic selection — where a constant sampling interval is used 
(e.g. every 50th balance) and the first item is selected randomly. 


. Monetary unit selection — selecting items based upon monetary values 
(usually focusing on higher value items). 


Non-statistical sampling methods 


. Haphazard selection — the auditor does not follow a structured technique 
but avoids bias or predictability. 


. Block selection — this involves selecting a block of contiguous items from 
the population (i.e. next to each other). To reduce sampling risk, many 
blocks should be selected as valid references cannot be made beyond the 
period or block examined. 


When non-statistical methods (haphazard and block) are used, the auditor uses 
judgement to select the items to be tested. Whilst this lends itself to auditor bias 
it does support the risk-based approach, where the auditor focuses on those 
areas most susceptible to material misstatement. 
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Designing a sample [ISA 530, A5, A6] 
When designing a sample, the auditor has to consider: 


The purpose of the procedure 
The combination of procedures being performed 
The nature of evidence sought 


Possible misstatement conditions. 


Sampling 


Murray Co deals with large retail customers, and therefore has a small 
number of large receivables balances on the list of individual customers. 
Given the small number of customers with an outstanding balance, all 
balances would probably be selected for testing. However, for illustrative 
purposes the following shows how a sample of balances would be 
selected using systematic and Monetary Unit Sampling. 


The number of items to be sampled has been determined as six. The 
customer list has been alphabetised. 


Systematic Sampling 


There are 19 customers with balances. The sampling interval is 
calculated by taking the total number of balances and dividing it by the 
sample size. The sampling interval (to the nearest whole number) is 
therefore three. The first item is chosen randomly, in this case item 10. 
Every third item after that is then also selected for testing until six items 
have been chosen. 
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Customer Ref Customer Name Balance Item Sampling 
$000 number Item 
A001 Anfield United Shop 176 1 
B002 The Beautiful Game 84 2 
B003 Beckham's 42 3 (5) 
c001 Cheryl & Coleen Co 12 4 
D001 Dream Team 45 5 
E001 Escot Supermarket 235 6 (6) 
G001 Golf is Us 211 7 
G002 Green Green Grass 61 8 
H001 HHA Sports 59 9 
J001 Jilberts 21 10 (1) 
J002 James Smit 
Partnership 256 11 
J003 Jockeys 419 12 
0001 The Oval 92 13 (2) 
P001 Pole Vaulters 76 14 
S001 Stayrose 
Supermarket 97 15 
T001 Trainers and More 93 16 (3) 
woo1 Wanderers 89 17 
W003 Walk Hike Run 4 18 
W004 Winners 31 19 (4) 
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Monetary Unit Sampling 
Monetary Unit Sampling can utilise either the random or systematic 
selection method. This example illustrates the systematic selection 
method. 
The cumulative balance is calculated. 
The sampling interval is calculated by taking the total value of 
$2,103,000 (to the nearest $000) and dividing by the sample size of 6. 
The sampling interval is therefore $351,000. 
The first item is chosen randomly (a number between 1 and 2,103,000), 
in this case 233. Each item after that is selected by adding the sampling 
interval to the last value until six items have been selected. 
Customer Ref Customer Name Balance Cumulative Sampling 
$000 Item 

A001 Anfield United Shop 176 176 
B002 The Beautiful Game 84 260 (1) $233 
B003 Beckham's 42 302 
c001 Cheryl & Coleen Co 12 314 
D001 Dream Team 45 359 
E001 Escot Supermarket 235 594 (2) $584 
G001 Golf is Us 211 805 
G002 Green Grass 61 866 
H001 HHA Sports 59 925 
J001 Jilberts 21 946 (3) $935 
J002 James Smit 

Partnership 256 1,202 
J003 Jockeys 419 1,621 (4) $1,286 
0001 The Oval 92 1,713 (5) $1,637 
P001 Pole Vaulters 76 1,789 
S001 Stayrose 

Supermarket 97 1,886 
T001 Trainers and More 93 1,979 
woo1 Wanderers 89 2,068 (6) $1,988 
w003 Walk Hike Run 4 2,072 
W004 Winners 31 2,103 
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Deviations 


Any issues identified during tests of control are called deviations. 
The auditor will: 


. Determine a level of deviation they are willing to accept — tolerable 
deviation rate. 


. Test the sample stated in the audit plan. 
. Extend the sample if deviations are identified. 
. Compare the actual deviation rate to the tolerable deviation rate. 


. Increase the level of substantive testing over the balance if the actual 
deviation rate exceeds the tolerable deviation rate. 


. Communicate the control deficiency causing the deviation with 
management and those charged with governance. 
Communication of control deficiencies is covered in more detail in the 
chapter ‘Systems and controls’. 


The auditor tests a sample of 100 purchase orders for evidence of 
authorisation and identifies 10 have not been authorised. This gives an 
initial deviation rate of 10%. 


The auditor will extend the testing to obtain more evidence about the 
deviation rate. A further 20 invoices are tested and no further deviations 
are identified, the deviation rate is now 8.3% (10/120 x 100). 


The tolerable deviation rate has been set at 5%. Therefore, the actual 
deviation rate is higher than the deviation rate the auditor is willing to 
accept. Increased substantive testing will be required over purchases as 
reliance cannot be placed on the controls. 


Misstatements 


Misstatements are differences between the amounts actually recorded and whai 
should have been recorded in the accounting records. Misstatements are 
identified when performing substantive tests of detail. 


The auditor will: 


. Determine a level of misstatement they are willing to accept — tolerable 
misstatement. 


. Test the sample stated in the audit plan. 
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Consider the nature and cause of the misstatement. If the misstatement is 


an anomaly (isolated), no further procedures are required as the 
misstatement is not representative of further misstatements. 


Project the misstatement found in the sample across the population as a 
whole, if the misstatement is not isolated. 


Compare the total projected misstatement to tolerable misstatement. 


- If the total projected misstatement in the sample is less than tolerable 


misstatement, the auditor may be reasonably confident that the risk 


of material misstatement in the whole population is low and no further 


testing will be required. 


- If the total projected misstatement in the sample exceeds tolerable 
misstatement, the auditor will extend the sample in order to 
determine the total misstatement in the population. 


Communicate the misstatement with management and ask them to correct 


it. Communication of misstatements is covered in more detail in the 
chapter ‘Completion and review’. 


A sample of $50,000 has been tested out of a population of $800,000. 
Misstatements of $2,000 were found. Tolerable misstatement has been 
set at $10,000. 


The auditor needs to consider whether the misstatement is an anomaly 
and therefore isolated, or whether the misstatement is likely to be 
representative of further misstatements in the population. 


If the misstatement is an anomaly, no further procedures will be 
necessary. 


If the misstatement is representative of further misstatements, the 
auditor will extrapolate the effect of the misstatement across the 
population to assess whether the projected misstatement is greater than 
tolerable misstatement. 


Here, the auditor might expect that there are misstatements of $32,000 
($2,000/$50,000 x $800,000) in the population. 


As the projected misstatement of $32,000 exceeds tolerable 
misstatement of $10,000, further audit testing will be required. 
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7 Automated tools and techniques 


Automated tools 
and techniques 


Test data Audit software Data analytical tools 


Test data 


Test data involves the auditor submitting 'dummy' data into the client's system 
to ensure that the system correctly processes it and that it prevents or detects 
and corrects misstatements. The objective of this is to test the operation of 
information processing controls within the system. 


To be successful test data should include both data with errors built into it and 
data without errors. Examples of errors include: 


. Codes that do not exist, e.g. customer, supplier and employee. 


. Transactions above predetermined limits, e.g. salaries above contracted 
amounts, credit above limits agreed with customer. 


. Invoices with arithmetical errors. 
. Submitting data with incorrect batch control totals. 


Data may be processed during a normal operational cycle (‘live’ test data) or 
during a special run at a point in time outside the normal operational cycle 
(‘dead’ test data). Both have advantages and disadvantages, for example: 


. Live tests could interfere with the operation of the system or corrupt 
master files/standing data. 


. Dead testing avoids this issue but only gives assurance that the system 
works when not operating live. This may not be reflective of the strains the 
system is put under in normal conditions. 


Advantages of test data 


. Enables the auditor to test programmed controls which wouldn't otherwise 
be able to be tested. 


. Once designed, costs incurred will be minimal unless the programmed 
controls are changed requiring the test data to be redesigned. 
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Disadvantages of test data 
. Risk of corrupting the client's systems. 


. Requires time to be spent on the client's system if used in a live 
environment which may not be convenient for the client. 


Audit software 


Audit software is used to interrogate a client's system. It can be either 
packaged, off-the-shelf software or it can be purpose written to work on a 
client's system. The main advantage of these programs is that they can be used 
to scrutinise large volumes of data, which would be inefficient to do manually. 
The programs can then present the results so that they can be investigated 
further. 


Specific procedures that can be performed include: 
. Extracting samples according to specified criteria, such as: 
- random 
— over a certain amount e.g. individually material balances or expenses 


- below a certain amount e.g. debit balances on the list of supplier 
balances or credit balances on the list of customer balances 


—  atcertain dates e.g. receivables or inventory over a certain age 


. Calculating ratios and indicators that fail to meet certain predefined criteria 
i.e. benchmarking) 


. Casting ledgers and schedules 

. Recalculation of amounts such as depreciation 

. Preparing reports (budget vs actual) 

. Stratification of data (such as invoices by customer or age) 


. Identifying changes to standing data e.g. employee or supplier bank 
details 


. Producing letters to send out to customers and suppliers. 


These procedures can simplify the auditor's work by selecting samples for 
testing, identifying risk areas and by performing certain substantive procedures. 
The software does not, however, replace the need for the auditor's own 
procedures. 


Advantages of audit software 

. Calculations and casting of reports will be quicker. 

. More transactions can be tested as compared with manual testing. 
. The computer files are tested rather than printouts. 


. Can be cost effective once set up. 
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Disadvantages of audit software 


aa 


Bespoke software (specific to a client) can be expensive to set up. 
Training of audit staff will be required incurring additional cost. 
The audit software may slow down or corrupt the client's systems. 


If errors are made in the design of the software, issues may go undetected 
by the auditor. 


Automated tools 


. Enables the auditor to test more items more quickly. 


. The auditor is able to test the system rather than printouts. 


. The results can be compared with other tests to increase audit 
confidence. 


. Audit tests can be performed more cost effectively. 


Disadvantages 


. Can be expensive and time consuming to set up. 
. Client permission and cooperation may be difficult to obtain. 
. Potential incompatibility with the client's computer system. 


. The audit team may not have sufficient IT skills and knowledge to 
create the complex data extracts and programming required. 


. The audit team may not have the knowledge or training needed to 
understand the results. 


. Data may be corrupted or lost during the process. 


Other types of automated tools 

Integrated test facilities — this involves the creation of dummy ledgers 
and records to which test data can be sent. This enables more frequent 
and efficient test data procedures to be performed live and the 
information can simply be ignored by the client when printing out their 
internal records. 


Embedded audit software — this requires a purpose written audit 
program to be embedded into the client's accounting system. The 
program will be designed to perform certain tasks (similar to audit 
software) with the advantage that it can be turned on and off at the 
auditor's wish throughout the accounting year. This allows the auditor to 
gather information on certain transactions (perhaps material ones) for 
later testing, and can identify peculiarities that require attention. 
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analytical tools 


Data analytics (DA) is the science and art of discovering and analysing 
patterns, deviations and inconsistencies, and extracting other useful 
information in the data of underlying or related subject matter of an audit 
through analysis, modelling, visualisation for the purpose of planning and 
performing the audit. 


Big data refers to data sets that are large or complex. 


Big data technology allows the auditor to perform procedures on very large 
or complete sets of data rather than samples. 


Features of data analytics 


DA can be used throughout the audit to help identify risks, test the 
controls, and as part of substantive procedures. The results still need to be 
evaluated using the professional skills and judgement of the auditor in 
order to analyse the results and draw conclusions. 


DA can incorporate a wider range of data. For example, data can be 
extracted and analysed from social media, public sector data, industry 
data and economic data. 


Benefits of data analytics 


The quality of the audit can be enhanced by the use of DA. DA enables 
the auditor to obtain a greater understanding of the entity and its 
environment. Professional scepticism and professional judgement are 
improved when the auditor has a better understanding. In addition, DA 
allows the auditor to manipulate 100% of the data in a population quickly, 
reducing sampling risk. 

Results can be visualised graphically which may increase the user- 
friendliness of the reports. 


Audit procedures can be performed more quickly and to a higher standard. 
This provides more time to analyse and interpret the results rather than 
gathering the information for analysis. 


Audit procedures can be carried out on a continuous basis rather than 
focused on the year end. 


Reporting to the client and users will be more timely as the work may be 
completed within weeks rather than months after the year end. 


The use of DA may result in more frequent interaction between the auditor 
and client over the course of the year. 


A reduction in billable hours as audit efficiency increases. Although this is 
good news for the client, it will mean lower fees for the auditor. 
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Limitations of data analytics 


There are still limitations to the audit and therefore auditors need to be careful 
not to place too much confidence into the use of DA which could have a 
negative impact on audit quality. 


As with analytical procedures in general, the quality of DA depends on the 
reliability of the underlying data used. The data may not be complete, well- 
controlled or from a reliable source. 


Financial statements still contain a significant number of estimates. 


DA will not replace the need for auditors to use professional scepticism 
and professional judgement. 


Because of these limitations, the auditor is still only able to give reasonable 
assurance even though 100% of a population may be tested. 
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Risk assessment 


. DA may be used to analyse the number of journals posted 
manually and automatically by the system; the number of people 
processing journals and the time of day the journals are posted. 
This can help with the auditor’s assessment of risk due to fraud if: 


— The number of manual versus automatic journals increases 
significantly. 

— The number of people processing journals increases. 

— Journals are posted outside of normal working hours. 


. DA may be used to perform ratio analysis at the risk assessment 
stage to help identify risks of material misstatement. 


. The information system of a client can be accessed directly or by 
download to enable the auditor to obtain an understanding of how 
ransactions flow through the system. 


Substantive procedures 


. Drones may be used to perform inspections of inventory where the 
auditor is unable to attend or physical access is restricted. 


. DA can be used to perform substantive analytical procedures such 
as ratio analysis or trend analysis in respect of sales and 
purchases. 


. DA may be used to identify if ledgers with zero balances are due to 
a number of offsetting transactions indicating that the ledger 
balance may be significant. 
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‘The Growing Use of Data Analytics in an Audit - | 


What it means for the profession 


. Larger accountancy firms are developing their own data analytic 
platforms. This requires significant investment in computer 
hardware and software, training of staff and quality control. 


. Small firms are unlikely to have the resources available to develop 
their own software as the cost is likely to be too prohibitive. 
However, external computer software companies have developed 
audit systems that work with popular accounting systems such as 
Sage, Xero and Intuit which many clients of small accountancy 
firms may be using. 


. Medium sized firms may also find the level of investment too 
restrictive and may therefore be unable to compete with the larger 
audit firms for listed company audits. However, these firms may find 
that listed companies require systems and controls assurance work 
which their auditors would not be allowed to perform under ethical 
standards. 


Developments within the profession 


Currently, ISAs take a systems-based approach to audit, which seeks 
to obtain audit evidence by placing reliance on internal controls rather 
than on carrying out extensive substantive tests of detail. The 
development of DA represents a significant progression away from 
traditional auditing methods. Therefore, as they become more widely 
used, ISAs will need to be updated to reflect this innovation in auditing 
techniques. 


The IAASB has a responsibility to develop standards that reflect the 
current environment and facilitate a high-quality audit. Auditors, audit 
oversight authorities and standard setters need to work together to 
explore how developments in technology can support enhanced audit 
quality. 


Auditors and businesses operate in an environment with larger volumes 
of transactions, greater complexity and greater regulation as a result of 
corporate failures. Technological change means information systems 
are capable of capturing, analysing and communicating significantly 
more data than previously. As a result, stakeholders are expecting the 
auditor to perform an audit that includes greater use of technology 
including DA. 


Challenges that impact the use of Data Analytics 


Data acquisition and retention — The entity's data will need to be 
transferred to the auditor raising concerns over data security and 


privacy as well as creating storage problems for such large data sets. 
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Conceptual challenges — Auditors will be asking questions they have 
never asked in the past and the client may be hesitant to provide all of 
the information requested. 


Legal and regulatory challenges — Regulations may prohibit data 
leaving the jurisdiction the entity is located. This may pose a problem if 
the IT facilities of the client are located in a different country. 


Resource availability — Data scientists may form part of a centralised 
department which supports all engagement teams within the firm. The 
resources are likely to be limited which will put a strain on resources. 


How regulators and audit oversight authorities maintain oversight 
— These bodies have little experience themselves of inspecting audits 
using DA. 


Investment in retraining and reskilling auditors — Changing the 
auditor's mind-set from traditional audit methods will require time and 
investment. 


The use of DA and developments in auditing standards will impact: 
Risk assessment — DA may improve the risk assessment process. 


Quality control — Audit firms will need to consider how specialist 
teams are supervised and how they interact with the audit teams they 
support. Firms will need to consider the integrity of the DA software to 
ensure it does what it is supposed to. 


Group audits — DA may help by enabling better analytical procedures 
to be performed in respect of components that are not significant 
components. Also, the audit procedures may be more centralised 
enabling the group auditor to perform more procedures rather than 
relying on the work of a component auditor. 


Estimates and fair values — Due to large volumes of data that feed 
into the models used to develop accounting estimates, DA may be 
valuable in addressing audit risks associated with these data sources. 


Smaller audit firms — Smaller firms may not be able to make the 
required investment to develop DA tools. Audits of public sector entities 
may prove challenging as home-grown systems are more prevalent 
and data capture may be more difficult. 


Education — Auditors and accountants will need to be re-skilled to 
realise the potential of DA. Training and qualifications will need to 
reflect the increased use of DA for new entrants to the profession. 


Ethics — Due to auditors having access to large volumes of client data, 
there may be a need to update the Code of Ethics to enhance the 
requirements for confidentiality. 


Other auditing standards — There is also likely to be a need to revise 
other auditing standards such as ISA 240 (Fraud), ISA 320 
(Materiality), ISA 330 (Responses to risks), ISA 500 (Audit Evidence), 
ISA 520 (Analytical Procedures) and ISA 530 (Audit Sampling). 
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FRC Audit Quality Thematic Review — The Use of Data Analytics in 
the Audit of Financial Statements 


With the increasing use of data analytics, the FRC has performed a 
review to identify what is working well with a view of sharing information 
to promote continuous improvement in audit quality. The Audit Quality 
Review (AQR) team assessed the use of DA in the six largest audit 
firms. 


Current use of data analytics 


. Analyse all transactions in a population, stratify the population and 
identify outliers for further examination. 


. Reperform calculations. 

. Match transactions as they pass through the system. 
. Assist in segregation of duties testing. 

. Compare client data with externally obtained data. 


. Perform sensitivity analysis. 


Impact on audit quality 

Audit quality is a driver for the implementation of DA. DA can: 

. Deepen the auditor's understanding of the entity. 

. Facilitate testing of the highest risk areas through stratification. 
. Enhance the use of professional scepticism. 

. Improve consistency on group audits. 

. Enable the auditor to test entire datasets. 

. Improve audit efficiency. 

. Increase the possibility of identifying fraud. 


. Provide a channel for enhanced communication with audit 
committees. 


Good practices observed during the AQR 

. Focused roll out of a DA tool. 

. Clear positioning within the audit methodology. 
. Testing or trial running the DA tool. 


. Using specialist staff and clearly defined roles between the 
specialists and the core engagement team. 


. Central running of DA for group audits. 


. Clearly documenting the DA tool using flowcharts. 
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Summary of key findings 


The introduction of mandatory retendering in the UK has provided 
incentive for firms to develop DA tools as this acts as a key 
differentiator. 


UK firms are at the forefront of developing DA tools. 


The pace of change is not as fast as expected by audit 
committees and investors. 


Whilst some firms are investing heavily in DA tools, they are not 
monitoring their use by audit teams or effectiveness at providing 
appropriate evidence. 


Some audit teams have over-emphasised their use to audit 
committees. In some cases, DA have been used to provide insight to 
the audit committee rather than to generate audit evidence. In 
another case, a firm described a DA tool as launched in a report but 
was described to the Audit Quality Review team as being in pilot 
stage. 

All firms used DA to assist with journal entry testing, however, 
most firms are not using DA tools routinely in other audit areas. 


For complex entities it can take two years to achieve the full 
benefits of a DA approach. 


The main barrier to effective use relates to difficulties obtaining 
entity data and audit teams often lack expertise to extract the data 
required. 


The use of DA techniques was higher at firms where the audit 
methodology clearly defines the purpose of the DA. 


In the audits tested, insufficient evidence audit evidence was 
retained on file. 


- Criteria input into the DA tool was not retained. 

- Screenshots omitted important information. 

- Evidence produced by specialists was omitted. 

- Firm's archiving tools were not able to archive DA evidence. 


- It may not be technically, practically or legally possible for 
the audit firm to retain audit evidence for the file retention 
period required by auditing standards. 
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Exploring the Growing Use of Technology in the Audit, with a 
Focus on Data Analytics 


In September 2016, IAASB issued a request for input from accounting 
firms, regulatory bodies, standard setters, academics and public sector 
organisations to obtain information about the current use and future 
direction of the use of data analytics. 


The key messages from the Feedback Statement published in January 
2018 are: 


. ISAs are not ‘broken’ and should remain principles-based. There 
should be no rush to change requirements in ISAs at present. 


. ISAs should be updated in a way that reflects current technology 
but remains technologically neutral to provide the ability to 
accommodate future changes in technology. ISA 500 Audit 
Evidence and ISA 230 Audit Documentation were highlighted as 
priorities for revision. 


. Non-authoritative, practical guidance with real-life examples of the 
use of DA is needed. This process has already commenced. 


. The use of DA does not reduce the need to exercise professional 
scepticism and judgement. Both are integral to understanding the 
benefits and limitations of using DA in the audit. 


Areas of concern 


Regulators and oversight authorities are most concerned with data 
acquisition, auditor skills and compliance with ISAs. 


. Audit clients may be reluctant to give access to live systems and 
this may cast doubt on the reliability of the data being analysed. 


. Currently auditors tend to have insufficient understanding of IT to 
design effective procedures using DA. 


. Audit evidence generated from DA must demonstrate that the 
requirements of the ISAs have been met, particularly the 
documentation requirements. 


Accounting firms are also concerned about retraining and re-skilling 
not only auditors, but also regulators and audit committees who will 
need to understand the DA performed as part of assessing the work of 
the auditor. There is also concern that these authorities have little 
experience themselves of inspecting audits involving the use of DA. 
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Auditing around the computer 


This term means that the 
‘internal’ software of the 
computer is not documented or 
audited by the auditor, but the 


inputs to the computer are 
agreed to the expected outputs 
to the computer 


Audit outcome 


Increase the AUDIT 
RISK Why? 


Where errors are found it 

may be difficult or even 
impossible to determine 

why those errors have occurred. 


The actual computer files 
and programs are NOT 
TESTED. 


Therefore no DIRECT 
evidence that the programs 
are working as documented 


If the issues cannot be resolved, 
a modified audit report may 
needed. 


Test your understanding 1 


List FOUR factors that influence the reliability of audit evidence. 
(4 marks) 


Test your understanding 2 


List and explain FOUR methods of selecting a sample of items to 
test from a population in accordance with ISA 530 Audit Sampling. 


(4 marks) 


Test your understanding 3 


List and explain FOUR factors that will influence the auditor’s 
judgement regarding the sufficiency of the evidence obtained. 


(4 marks) 
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Test your understanding 4 


You are assigned to the audit of Lamp Co. You are currently reviewing 
the audit work performed to date. 


Tolerable deviation rate is 5%. 
Tolerable misstatement is $3,000. 
Tests of controls over revenue 


During controls testing, the audit team tested a sample of 50 sales 
invoices for evidence of a second person checking the prices charged 
on the invoice to the company’s approved price list, the goods invoiced 
to the goods despatched note and an arithmetical check of the invoice 
total. In four cases the checks had not been performed. 


The sample was chosen by selecting every 37th invoice in the 
population. 


Substantive procedures over purchases 


During substantive testing, the audit team tested a sample of 50 
purchase invoices from the detailed purchases listing and traced the 
amounts back to the physical invoices for accuracy. Two invoices were 
recorded inaccurately, resulting in a total misstatement within the 
sample of $198. 


The total of the sample tested was $2,500. The total purchases figure 
included in the statement of profit or loss is $43,000. 


The sample was chosen by the auditor selecting 50 invoices from 
anywhere in the detailed purchases listing, trying to avoid bias. 


1 In respect of the tests of controls over revenue, which TWO of 
the following are appropriate responses? 


(i) Pick alternative items to test in place of those just tested and 
ignore the deviations. 


(ii) Extend the sample size. 

(iii) Perform increased substantive testing. 

(iv) Extrapolate the deviation across the population. 
A (i)and (ii) 

B (ii) and (ii) 

C (i) and (iv) 

D (iii) and (iv) 
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In respect of the substantive testing performed over 
purchases, what action should the auditor now take? 


A Inform the client of the misstatement and ask them to correct it 


B Calculate the materiality of the misstatement in relation to the 
financial statements 


C Extend the sample 
D Compare the misstatement with the tolerable deviation rate 


Select the sampling method used in each of the procedures 
stated. 


Test of controls over 


Haphazard | Random | Systematic 
revenue 


Substantive procedure over 


purchases Haphazard | Random | Systematic 


Which of the following statements is TRUE? 


A Sampling refers to where less than 100% of the items ina 
population are tested and have an equal chance of selection 


B Deviations must be extrapolated to determine the effect on the 
population 


C Block sampling is where the auditor tests all items in a 
population 


D Monetary unit sampling is a statistical method of sampling 
Select whether the following statements are TRUE or FALSE. 


Statistical sampling methods are 
more reliable than non-statistical TRUE FALSE 
methods 


The auditor must always use 
stratification to ensure a TRUE FALSE 
representative sample is tested 


More than one sampling method may TRUE FALSE 
be used to test one population 


A deviation occurs when a result 
differs from expectation during a TRUE FALSE 
substantive procedure 
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Test your understanding 5 


You are planning the audit of Wyndham Co. The company sells 
diamonds and other precious stones. You have decided to use the 
work of an auditor's expert to provide sufficient appropriate evidence 
over the valuation of inventory. 


1 Before appointing an auditor's expert, what factors must the 
auditor consider? 


(i) Competence 

(ii) Capability 

(iii) Objectivity 

(iv) Reliability of the source data 
A (i), (ii) and (iii) 

B (ii), (iii) and (iv) 

C (i) (iii) and (iv) only 

D (i), (ii), (iii) and (iv) 


2 How can the auditor assess the competence of an auditor's 
expert? 


(i) | Obtain copies of professional certificates and make enquiries 
of the expert's experience. 


(ii) Ask for confirmation from the expert of their independence. 


(iii) Inspect the register of members of the relevant professional 
body for the name of the expert. 


A _ (i) and (ii) only 
B (ii) and (iii) only 
C (i) and (iii) only 
D (i), (ii) and (iii) 


3 What must be agreed with the auditor's expert in writing 
before the work is performed? 


(i) | Responsibilities of each party 
(ii) Inherent limitations of the audit 
(iii) Deadline for the work 

(iv) Scope and objectives 

A (i), (ii), (iii) and (iv) 

B (i), (iii) and (iv) only 

C (iii) and (ii) only 

D (i), (ii) and (iv) only 
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Which of the following statements is TRUE in respect of the 
expert's work? 


A The auditor can rely on the expert's work and does not need 
to review it 


B The auditor may choose not to review the expert's work if it 
is an area in which the auditor has knowledge or experience 


C The auditor must review the assumptions and source data 
used by the expert to ensure they were reasonable and 
reliable 


D The auditor will engage a second expert to review the work 
of the first to ensure sufficient appropriate evidence has 
been obtained 


Which of the following statements best describes a 
management's expert? 


A A management's expert is an employee of the company 


B A management's expert is someone appointed by the 
company to provide evidence for the auditor 


C A management's expert is someone recommended by the 
auditor which management appoints to provide evidence for 
the audit 


D A management's expert is someone appointed by the 
company to provide evidence for management which may be 
relied upon by the auditor 
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8 Chapter summary 


Types of audit 


procedures 


m 
Tests of Controls 
i—mar 
— 
*] Substantive 
aaoo 


Relying on the 
work of others 


Automated tools 
and techniques 
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Test your understanding answers 


qj Test your understanding 1 


Reliability of audit evidence [ISA 500, A31] 


Audit evidence is more reliable when it is obtained from 
independent sources outside the entity. 


Audit evidence that is generated internally is more reliable when 
the related controls imposed by the entity are effective. 


Audit evidence obtained directly by the auditor (for example, 
observation of the application of a control) is more reliable than 
audit evidence obtained indirectly or by inference (for example, 
inquiry about the application of a control). 


Audit evidence is more reliable when it exists in documentary form, 
whether paper, electronic, or other medium. (For example, notes of 
a meeting taken during the meeting are more reliable than a 
subsequent oral representation of the matters discussed.) 


Audit evidence provided by original documents is more reliable 
than audit evidence provided by photocopies or facsimiles (fax). 


Only four examples are required. 


(TI Test your understanding 2 


Sampling methods [ISA 530, Appendix 4] 
Methods of sampling in accordance with ISA 530: 


Random selection. Ensures each item in a population has an 
equal chance of selection, for example by using random number 
tables. 


Systematic selection. In which a number of sampling units in the 
population is divided by the sample size to give a sampling 
interval. 


Haphazard selection. The auditor selects the sample without 
following a structured technique — the auditor would avoid any 
conscious bias or predictability. 


Block selection. Involves selecting a block(s) of contiguous items 
from within a population. 


Monetary unit sampling. This selection method ensures that 
each individual $1 in the population has an equal chance of being 
selected. 


Note: Only four sampling methods were required. 
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qj Test your understanding 3 


Sufficiency of evidence 


. Assessment of risk at the financial statement level and/or the 
individual transaction level. As risk increases then more evidence 
is required. 


. The materiality of the item. More evidence will normally be 
collected on material items whereas immaterial items may simply 
be reviewed to ensure they appear materially correct. 


. The nature of the accounting and internal control systems. The 
auditor will place more reliance on good accounting and internal 
control systems reducing the amount of substantive evidence 
required. 


. The auditor's knowledge and experience of the business. Where 
the auditor has good knowledge of the business and trusts the 
integrity of staff then less evidence will be required. 


. The findings of audit procedures. Where findings from related 
audit procedures are satisfactory (e.g. tests of controls) then less 
substantive evidence will be collected. 


. The source and reliability of the information. Where evidence is 
obtained from reliable sources (e.g. written evidence) then less 
evidence is required than if the source was unreliable (e.g. verbal 
evidence). 
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qj Test your understanding 4 


4 


B 


Extend the sample size and perform more 
substantive tests. The auditor should never 
disregard deviations or misstatements identified 
during testing. It is not appropriate to extrapolate a 
deviation rate across a population. 


The misstatement must be extrapolated across the 
population. 198/2,500 x 43,000 = $3,406. This 
exceeds tolerable misstatement of $3,000 therefore 
the auditor must perform further audit procedures 
by extending the sample. 


Systematic 
Haphazard 


Tests of control over revenue have used 
systematic sampling. This is when a constant 
sampling interval is used e.g. every 37th item. 


Substantive procedures over purchases have used 
haphazard sampling. This is when the auditor 
selects the sample without a pattern and tries to 
avoid bias. 


Sampling is when each item in a population has a 
chance of selection. They do not need to have an 
equal chance. 


Deviations are not extrapolated as the deviation 
rate will be the same across the population. 


Block sampling is where items next to each other in 
the population are tested. 


False 
False 
True 


False 


Statistical sampling methods are not necessarily 
more reliable than non-statistical methods. The 
auditor must use professional judgement to choose 
whichever is appropriate in the circumstances. 


Stratification should be used when a population is 
not homogenous. If the population is homogenous, 
stratification will not be necessary. 


More than one sampling method may be used to 
test the same population. If the population has 
been stratified, the auditor may use different 
sampling methods for each sub-population. 


A deviation occurs when a result differs from 
expectation when the auditor performs tests of 
controls. 
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qj Test your understanding 5 


1 


A 


Reliability of source data is evaluated after the expert 
has performed the work. 


Cc 


An independence confirmation from the expert would 
confirm objectivity but not competence. 


Inherent limitations of an audit would not be 
communicated to the expert. This would be included 
in an audit engagement letter. 


The auditor cannot just rely on the expert's work. 
They must review it to ensure it provides sufficient 
appropriate evidence and therefore must consider the 
assumptions and source data. If the auditor already 
had knowledge and experience in this area there 
would be no need to use an auditor's expert. If the 
auditor has evaluated the competence, capability and 
objectivity of the expert before using them, there 
should be no need to appoint a second expert to the 
review the first expert's work. 


A management's expert is appointed by 
management to produce evidence to be used by 
management. If the evidence is reliable and relevant 
to the external audit, the auditor may choose to rely 
on that work. 
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Chapter learning objectives 


This chapter covers syllabus areas: 
. C1 — Systems of internal control 


. C2 — The use and evaluation of systems of internal control by 
auditors 


. C3 — Tests of controls 
. C4 — Communication on internal control 


Detailed syllabus objectives are provided in the introduction 
section of the text book. 


One of the PER performance objectives 
(PO19) is to collect and evaluate evidence for 
an audit. Carry out an internal or external audit 
from collecting evidence, through to forming an 


opinion. You demonstrate professional 
scepticism and make sure judgements are 
based on sufficient valid evidence. Working 
through this chapter should help you 
understand how to demonstrate that objective. 
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SYSTEMS 


INTERNAL CONTROL 


CONTROL ACTIVITIES 


COMPONENTS 


HOW CONTROLS 
OPERATE 


TESTING CONTROLS 


COMMUNICATING 
DEFICIENCIES 


* The basics of an internal control system were covered in Business 
Technology (previously Accountant in Business) at the Applied Knowledge 
level. This chapter develops this area further and looks at how the client's 
system of internal control influences the audit approach taken and the 
audit evidence gathered. 


1 Effect of controls on the audit 


This chapter considers the basic components of an internal control system, and 
how the auditor fulfils their objectives for assessing control risk. 


As we saw in Chapter 5, control risk is one of the factors affecting the risk of 
material misstatement. If a client's system of internal control is designed 
appropriately, implemented and working effectively, there will be less risk of 
material misstatement in the financial statements as the controls will have either 
prevented the misstatements from occurring in the first place, or will have 
detected the misstatements and prompted action for them to be corrected. The 
auditor will use this assessment of control risk to determine the impact on the 
audit strategy and audit plan. 
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Impact of tests of controls on the audit strategy and plan 


The extent of substantive testing to be carried out will depend on the results of 
the auditor's assessment of control risk. 


If control risk is low 


. The auditor can place more reliance on internal controls and evidence 
generated internally within the entity. 


. This increases the appropriateness of interim audit testing and allows the 
auditor to reduce the quantity of detailed substantive procedures 
performed at the final audit stage. 


. The audit strategy and plan will be updated to reflect that fewer 
substantive procedures will be required or smaller sample sizes can be 
tested at the final audit stage. 

If control risk is high 


The auditor will: 


. Increase the volume of procedures conducted at and after the year end. 
ISA 330, A2] 

. Increase the level of substantive procedures, in particular, tests of detail. 
ISA 330, A2] 

. Increase the locations included in the audit scope. [ISA 330, A2] 


. Place less reliance on analytical procedures as the information produced 
by the client's systems is not reliable. 


. Place less reliance on written representations from management if the 
control environment is weak. 


. Obtain more evidence from external sources e.g. external confirmations 
rom customers and suppliers. 


. Update the audit strategy and plan to reflect the additional testing required 
at the final audit stage. 


Limitations of internal controls 


The auditor can never eliminate the need for substantive procedures entirely 
because there are inherent limitations to the reliance that can be placed on 
internal controls due to: 


. Human error — mistakes made by those responsible for performing 
controls. 


. Ineffective controls — controls which do not work as intended. 


. Collusion of staff — staff work together (collude) to bypass the control of 
segregation of duties. 
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. The abuse of power by those with ultimate controlling responsibility 
(management override) - management may falsify accounting records or 
post unauthorised journals to present a different result in the financial 
statements. 

. Use of management judgement on the nature and extent of controls it 
chooses to implement. 


[ISA 315 (Revised 2019), Appendix 3, 22 — 24] 


As a result of these limitations, the auditor must always perform substantive 
testing on material balances in the financial statements. [ISA 330, 18] 


ea 


Human error 


Warehouse staff are required to check the quantity of the goods 
received to the authorised purchase order however an error may be 
made when counting. 


Ineffective controls 


The sales manager is required to authorise the mileage claims of sales 
representatives within their department. The authorisation process 
should include a check that the mileage claimed is reasonable however 
the department manager performs no checks and simply signs off the 
claim as authorised. 


Collusion 


Within the payroll department, a payroll clerk processes timesheets and 
overtime claims and the payroll manager authorises the payroll for 
payment, however the clerk and manager are related and collude to 
enable the clerk to increase the overtime paid to themselves. 


Management override 


During the preparation of the financial statements, the finance director 
falsifies the accounting records by posting a journal to increase 
revenue to show a desired level of profit required to meet a loan 
covenant. 


Use of management judgement 


Last year’s report to management contained several recommendations 
for improvements to the client's controls which exposed the company to 
fraud and error. During the current year audit the audit manager 
identified that no action had been taken in response to the 
recommendations. When the matter was discussed with the finance 
director, the audit manager was told that the cost of implementing the 
controls outweighed the benefits and therefore the company would not 
be acting on the recommendations. 
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2 Components of internal control 


ISA 315 (Revised 2019), states that the auditor needs to understand an entity's 
internal controls. To assist this process, it identifies five components: 


Components of internal control 


Information System 


Control activities 


[ISA 315 (Revised 2019),12m] 


Control environment | £ Risk assessment process 


The control environment includes the governance and management function 
of an organisation. 


It focuses largely on the attitude, awareness and actions of those responsible 
for designing, implementing and monitoring internal controls. 


The control environment sets the tone of an organisation and provides the 
foundation for the other components of the entity's system of internal control. 


[ISA 315 (Revised 2019), Appendix 3, 4] 
Elements of the control environment: 


. How management's responsibilities are carried out, demonstrating 
management’s commitment to integrity and ethical values. 

. How those charged with governance demonstrate independence from 
management and exercise oversight of the system. 

. How the entity assigns authority and responsibility in pursuit of its 
objectives. 

. How the entity attracts, develops and retains competent people including 


recruitment policies, training policies and performance appraisals. 


. How the entity holds individuals accountable for their responsibilities 
e.g. performance measures and disciplinary policies. 


[ISA 315 (Revised 2019), Appendix 3, 6] 


When assessing the control environment, the auditor may consider how 
management has responded to the findings and recommendations of the 
internal audit function regarding identified control deficiencies. 
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The auditor must also assess whether any controls implemented as a result of 
those recommendations have been subsequently evaluated by the internal audit 
function. [ISA 315 (Revised 2019), Appendix 4, 7] 


Evidence regarding the control environment is usually obtained through a 
mixture of enquiry and observation, although inspection of key internal 
documents (e.g. codes of conduct and organisation charts) is possible. 


The auditor must obtain an understanding of the entity’s process for identifying 
business risks relevant to financial reporting, assessing the significance of those 
risks and addressing those risks. The auditor must then evaluate whether the 
process is appropriate to the entity’s circumstances taking into consideration the 
nature and complexity of the entity. [ISA 315 (Revised 2019), 22] 


The risk assessment process forms the basis for how management determines 
the risks to be managed. However, the auditor is only interested in the business 
risks relevant to the preparation of the financial statements. 

[ISA 315 (Revised 2019), Appendix 3, 7, 8] 


Business risks relevant to financial reporting are threats to the achievement of 
ongoing business objectives and can lead to misstatement in the financial 
statements. 


Examples include: 

. New information systems and technology 

. Rapid growth 

. New accounting requirements/principles 

. Maintaining the integrity of data and information processing 


. Risks to the entity’s business strategy if the entity's IT strategy does not 
effectively support the business strategy 


. Interruptions in the IT environment when the entity does not make 
necessary updates to the IT environment or such updates are not timely. 


[ISA 315 (Revised 2019), Appendix 3, 9] 


If the client has robust procedures for assessing the business risks it faces, the 
tisk of misstatement overall will be lower. 


If the auditor identifies instances where management failed to identify risks of 
material misstatement, they should obtain an understanding of why the entity's 
process failed to identify the risks and consider the implications for the audit. 
[ISA 315 (Revised 2019), 23] 
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The entity’s process to monitor the system of internal control 
This is the client's continual process of evaluating the effectiveness of controls 
over time and taking necessary remedial action. 


Monitoring can be either ongoing or performed on a separate evaluation basis 
(or a combination of both). 


[ISA 315 (Revised 2019), Appendix 3, 10] 
Monitoring of internal controls is often the key role of the internal audit function. 


(iv) The information system and communication 


The information system relevant to financial reporting consists of all of the 
activities and policies relevant to financial reporting and communication. It 
includes the procedures within both computerised and manual systems. 


The information system includes all of the procedures and records which are 
designed to: 


. Initiate, record, process and report transactions. 

. Maintain accountability for assets, liabilities and equity. 
. Resolve incorrect processing of transactions. 

. Process and account for system overrides. 

. Transfer information to the general ledger. 


. Capture information relevant to financial reporting for other events and 
conditions. 


. Ensure information required to be disclosed is appropriately reported. 
[ISA 315 (Revised 2019), Appendix 3, 15] 


(v) Control activities 


Control activities are the policies (statements of what should or should not be 
done) and procedures (actions to implement policies) to achieve the control 
objectives of management and those charged with governance. 


Examples of specific control activities include those relating to: 
. Authorisation to confirm the validity of a transaction. 
. Reconciliations to address the completeness or accuracy of transactions. 


. Verifications to address the completeness, accuracy or validity of 
transactions. 


. Physical or logical controls to prevent theft of assets or data. 


. Segregation of duties to reduce opportunity for any person to commit and 
conceal fraud in the normal course of their duties. 


[ISA 315 (Revised 2019), Appendix 3, 20] 
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ia Tutorial note 


A control objective identifies the risk that the entity needs to manage 
i.e. the reason for a control procedure or activity being required. 


For example, a risk within a purchasing system is that purchases could be 
made for personal use and paid by the company. Therefore, the control 
objective is to ensure goods cannot be purchased for personal use. 


Most companies would have a control procedure in place to prevent this 
tisk from occurring, such as authorisation of purchase orders by a 
responsible official. 


Authorisation 


. A manager signing off an employee's timesheet to confirm that the 
hours stated have been worked and can be paid. This should 
ensure the employee is not claiming for hours not worked. 

. A manager signing a purchase order to confirm the order can be 
placed with the supplier. This should ensure that the goods are for 
a valid business use and the items are needed. 


Reconciliation 


. Preparation of a bank reconciliation to ensure cash transactions 
have been recorded completely and accurately. 


. Reconciliation of supplier statements with the list of individual 
suppliers to ensure completeness and accuracy of payables. 


Verification 


. Managers should compare actual spend against budgeted spend 
o detect unusual fluctuations. If actual spend is significantly 
higher than budget, the department may have spent more than it 
should or it could indicate an error when processing the 
ransactions. 


. Batch totals used when inputting data to ensure items are not 
omitted. 


Physical or logical controls 


. Restrictions on access to assets such as keeping cash in a safe 
to prevent theft. 


. Password restrictions to prevent unauthorised access to computer 
files. 
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Segregation of duties 


. Warehouse staff should not be responsible for the inventory count 
as this would not detect if goods were being stolen by staff 
throughout the year. 


. Employees who authorise transactions should not be the ones 
who originate the transaction. 


Controls may be direct or indirect. A direct control addresses the risk of 


materi 


For example, a manager's review of the payroll total each month to ensure the 
amount to be paid is in line with expectation is an indirect control as it does not 


al misstatement at the assertion level. [ISA 315 (Revised 2019), A5] 


specifically address an assertion. Agreeing the amounts on the payroll list to 
individual payslips would address the assertion of accuracy and is therefore a 
direct control. 


Indirect controls support the direct controls. The general IT controls given below 


are examples of indirect controls. 


ea 


Sales 


A credit check on a customer reduces the risk of sales being made to a 
customer who may be unable to pay thereby reducing the risk of 
irrecoverable debts. This reduces the risk of misstatement of 
receivables. 


Purchases 


Purchase requisitions and orders must be approved before being 
placed with a supplier. Authorisation ensures the purchase is for a valid 
business use reducing the risk of fraudulent purchases being made. 
Purchases will be misstated if a fraudulent purchase is made as it will 
not pertain to the entity and therefore will not have occurred. 


Payroll 


The payroll software calculates payroll amounts and a payroll 


supervisor performs a sample check of calculations to ensure accuracy. 


The sample check reduces the risk of misstatement of the payroll 
expense. 


Inventory 


Rotation of inventory in the warehouse ensures the oldest inventory is 
sold first which means there is less chance of perishable items going 
out of date before being sold. This reduces the risk of inventory 
needing to be scrapped which could cause misstatement if inventory is 
not valued appropriately. 


Non-current assets 


A unique serial number is assigned to each asset and recorded on the 
asset register which enables the entity to ensure completeness. 
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IT controls 


The level of risk arising from the IT environment will vary from client to client 
depending on the nature and extent to which the entity uses technology. More 
complex IT systems may involve the use of emerging technologies such as 
blockchain, or may involve the client changing the source code of the program. 
Less sophisticated systems may simply be a user interface in which the client 
enters data which the system processes. 


Regardless of the scale of complexity, the auditor must always identify the IT 
application and other aspects of the entity's IT environment that are subject to 
risks arising from the use of IT and identify the related risks arising from the use 
of IT and the general controls in place to address those risks. 

[ISA 315 (Revised 2019), 26] 


IT controls are normally divided into general controls and information 
processing controls. An effective IT system should include both. 
General controls 


General IT controls support the continued proper operation of the IT 
environment, including effective functioning of the information processing 
controls and the integrity of information in the information system. [ISA 315 
(Revised 2019), 12d] 


E.g. controls over: 


. Access - Preventing unauthorised access to applications, databases, 
operating system, networks. 


. Program changes or other changes to the IT environment — Segregation of 
duties, system development, data conversion. 


. Process to manage IT operations — job scheduling, job monitoring, backup 
and recovery, intrusion detection. 


[ISA 315 (Revised 2019, Appendix 6, 2] 


Information processing controls 


Information processing controls relate to the processing of information in IT 
applications or manual processes that directly address risks to the integrity of 
information. [ISA 315 (Revised 2019), 12d] 


These controls may be automated (embedded in IT applications) or manual 
(e.g. input or output controls). [ISA 315 (Revised 2019), A6] 


Examples include: 


. Batch total checks (e.g. when entering invoices onto the system the 
system may give a batch total i.e. the number of invoices actually entered. 
The clerk entering the invoices can then double check that the correct 
number of invoices has been entered and none have been missed or 
entered twice). 
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. Sequence checks (to ensure the number sequence is complete and no 
items are missing). 


. Matching master files to transaction records (e.g. matching prices on sales 
invoices to the company’s price list to ensure the prices being applied are 
correct). 


. Arithmetic checks (to verify arithmetical accuracy). 
. Range checks (to ensure that data entered is within a reasonable range). 
. Existence checks (e.g. to check employees exist). 


. Authorisation of transaction entries (to ensure the transaction is valid and 
should be processed). 


. Exception reporting (the system may generate an exception report when 
something which isn't usual has occurred e.g. changes to bank details of 
employees which wouldn't be expected to change often). 


3 Ascertaining the systems 


Procedures used to obtain evidence regarding the design and implementation 
of controls include: 


. Enquiries of relevant personnel. 
. Observing the application of controls. 


. Tracing a transaction through the system to understand what happens 
(a walkthrough test). 


. Inspecting documents, such as internal procedure manuals. 


It should also be noted that enquiry alone is not sufficient to understand the 
nature and extent of controls. 


The auditor can also use existing knowledge of the client and the operation of 
the systems. However, they cannot simply rely on their knowledge from the 
prior year audit as changes may have occurred. Systems knowledge must be 
updated and the systems tested once more if it relates to an area of significant 
risk. For controls which do not address a significant risk, the auditor must test 
the controls at least once every third audit. [ISA 330, A37] 
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4 Documenting client’s systems 


The auditor must document the client's control systems before evaluating 
whether the system is adequate and working effectively. 


Possible ways of documenting systems include: 
. Narrative notes — a written description of a system. 
. Flowcharts — a diagrammatical representation of the system. 


. Questionnaires — a prepared list of questions in relation to the client's 
control system. There are two types of questionnaire that can be used: 


Internal Control Questionnaire (ICQ) — a list of controls is given to the 
client and they are asked whether or not those controls are in place. 


Internal Control Evaluation Questionnaire (ICEQ) — the client is asked 
to describe the controls they have in place for a given control objective. 


. Organisation chart — a diagram showing reporting lines, roles and 
responsibilities. 


ICQ wording ICEQ wording 

Does a supervisor authorise all How does the company ensure that 

weekly timesheets? only hours worked are recorded on 
timesheets? 

Does the company perform a How does the company try to 

regular credit check on all minimise the risk of irrecoverable 

customers? debts? 

Does a manager or director How does the company ensure goods 

authorise purchase orders before | are only purchased for a valid 


an order is placed? business use? 


Is a bank reconciliation 
performed regularly? 


ow does the company ensure 
iscrepancies in the bank ledger 
account are identified and resolved? 


Is a regular inventory count How does the company ensure its 
performed? inventory system is up to date and 

discrepancies in the inventory records 
are identified and corrected? 


Is a regular reconciliation How does the company ensure the 
performed between the physical | non-current asset register is up to 
non-current assets and the non- | date and accurate? 

current asset register? 


The method adopted is a matter of auditor judgement. 
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Documentation 
Method 


Advantages 


Disadvantages 


Narrative notes 


. Simple to record 


. Facilitates 
understanding by all 
audit staff 


. May be time consuming 
and cumbersome if the 
system is complex 


. May be more difficult to 
identify missing controls 


Flow charts 


. Easy to view the 
whole system in one 
diagram 


. Easy to spot 
missing controls due 
to the use of 
standard symbols 


. May be difficult to 
amend as the whole 
diagram may need to be 
re-drawn 


. There is still a need for 
narrative notes to 
accompany the flow 
chart increasing the time 
involved to document 
the system fully 


Internal control 
questionnaires 
(ICQs) 


. Quick to prepare as 
a standard 
questionnaire can 
be used for all 
clients 


. Can ensure all 
common controls 
are present 


. Controls may be 
overstated as the client 
knows the answer the 
auditor is looking for is 
'yes' 

. Unusual controls are 
unlikely to be included 
on a standard 
questionnaire and may 
not be identified 


. May contain a number of 
irrelevant controls 


Internal control 
evaluations 
(ICEs) 


. The client has to 
respond with the 
control they have in 
place rather than a 
yes/no answer 
which should mean 
controls are less 
likely to be 
overstated 


. Quick to prepare 


. The client may still 
overstate controls as 
they may say a control is 
in place for the control 
objective even if it is not 


. The checklist may 
contain control 
objectives not relevant 
to the client 


. Unusual risks and 
therefore objectives may 
not be identified 
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5 Testing the system 


Tests of controls are performed only on those controls that the auditor has 
determined are suitably designed to prevent, or detect and correct a material 
misstatement in a relevant assertion. [ISA 330, A20] 


Controls will only be worth testing if they are designed appropriately in the first 
place (i.e. they are capable of preventing or detecting and correcting 
misstatements) and implemented (i.e. the controls exist and the entity is using 
them). When a control is not designed or implemented effectively, there is no 
benefit in testing it. [ISA 315 (Revised 2019), A175, A176, A179] 


Typical methods of controls testing include: 


. Observation of control activities, e.g. observing the inventory count to 
ensure it is conducted effectively and in accordance with the count 
instructions. 


. Inspection of documents recording performance of the control, 
e.g. inspecting an order for evidence of authorisation. 


. Using test data to ensure the programmed controls are working effectively. 
See the 'Evidence' chapter). 


AR| | Designing valid tests of controls 


To design a test of control, the auditor must first identify the controls 
they want to test. 


A control is an activity applied in addition to the normal processing of 
the system to ensure that the system has operated as it should. 


Just because errors have not been made does not mean that controls 
have worked effectively. The person performing the processing may not 
have made any errors. There may have been no controls in place. 

A control is an additional activity to ensure the person has not made 
any errors. 


For example, if the client claims to perform bank reconciliations, the 
auditor should look at the file containing the reconciliations to verify that 
they are done, and then reperform the reconciliation to ensure it has 
been done properly, to test the effectiveness of the control. Simply 
performing the reconciliation and finding that it reconciles does not 
prove that the client has done the reconciliation themselves. Therefore, 
reperformance of the reconciliation on its own is not a valid test of 
control. 


Similarly, if the auditor performs a sequence check on a set of 
documents and finds the sequence is complete, it does not mean the 
client has performed a sequence check. It may just mean that no 
documents have gone missing. The auditor must look for evidence that 
the client has performed a sequence check to confirm no documents 
have gone missing. 
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6 Communicating control deficiencies 


ISA 265 Communicating Deficiencies in Internal Control to Those Charged with 
Governance and Management requires the auditor to: 


. Communicate any deficiencies that are of sufficient importance to merit 
management's attention to management. [ISA 265, 10] 


. Communicate significant deficiencies to those charged with governance. 
[ISA 265, 9] 


Deficiencies occur when: 


. A control is designed, implemented or operated in such a way that it is 
unable to prevent, or detect and correct misstatements in the financial 
statements on a timely basis, or 


. A control necessary to prevent, or detect and correct, misstatements in the 
financial statements on a timely basis is missing. 


[ISA 265, 6a] 


Significant deficiencies are those which merit the attention of those charged 
with governance. [ISA 265, 6b] 


The external auditor should consider the following when determining if a 
deficiency in internal controls is significant: 


. The likelihood of the deficiencies leading to material misstatements in the 
financial statements in the future. 


. The susceptibility to loss or fraud of the related asset or liability. 


. The subjectivity and complexity of determining estimated amounts. 


. The financial statement amounts exposed to the deficiencies. 


. The volume of activity that has occurred or could occur in the account 
balance or class of transactions exposed to the deficiency or deficiencies. 


. The importance of the controls to the financial reporting process. 


. The cause and frequency of the exceptions detected as a result of the 
deficiencies in the controls. 


. The interaction of the deficiency with other deficiencies in internal control. 
[ISA 265, A6] 


Report to management/management letter 


The auditor will communicate the deficiencies in a report to management or 
management letter. It is usually sent at the end of the audit and comprises a 
covering letter with an appendix containing the deficiencies the auditor has 
found within the client's control system(s) and recommendations to overcome 
each deficiency. 
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The covering letter will state that the control deficiencies identified during the 
audit are included in the appendix and will clarify that: 


. The report is not a comprehensive list of deficiencies, but only those that 
have come to light during normal audit procedures. 


. The report is for the sole use of the company. 


. No disclosure should be made to a third party without the written 
agreement of the auditor. 


. No responsibility is assumed to any other parties. 


Board of directors 

Murray Co 

1 Murray Mound 

Wimbledon 

WN1 2LN 

1 July 20X5 

Dear Sirs, 

Audit of Murray Co for the year ended 31 December 20X4 

Please find enclosed the report to management on deficiencies in 
internal controls identified during the audit for the year ended 

31 December 20X4. The appendix to this report considers deficiencies 
in the purchasing and payments system, the implications of those 
deficiencies and recommendations to address those deficiencies. 
Please note that this report only addresses the deficiencies identified 
during the audit and if further testing had been performed, then more 
deficiencies may have been reported. 


This report is solely for the use of management and if you have any 
urther questions, then please do not hesitate to contact us. 


Yours faithfully 


An audit firm 
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The appendix will set out the following: 


Deficiency and consequence 


Recommendation 


A clear description of what is 
wrong. 

What could happen if the 
deficiency is not corrected? 
Focus on what matters to the 
client — the risk of a reduction in 
revenue, extra costs, stolen 
assets, errors in the accounts. 


This must deal with the specific deficiency 
you have identified. It must also provide 
greater benefits than the cost of 
implementation. 


Try to specify exactly how the 
recommended control should operate, for 
example, suggest who should carry out the 
control procedure, and how frequently it 
should be performed. 


Control deficiency 


Recommendation 


Purchase invoices were missing 
from the sequentially numbered 
invoice file. 


There is a possibility that purchases 
and liabilities are not completely 
recorded. This could result in late 
payment of invoices which could 
cause damage to the company's 
relationship with the supplier 
resulting in removal of credit terms 
or discounts. 


All invoices should be 
sequentially filed on receipt by 
the accounts department. 
Regular sequence checks 
should be performed to ensure 
completeness. Any missing 
items should be investigated 
and copies requested if 
necessary. 


In the exam you may be required to prepare extracts for inclusion ina 
report to management. This requires you to only prepare the appendix, ina 
table format, as shown above. 


If you are also asked for a covering letter, you must produce a letter, as 
shown in the example above, as well as the appendix. There will be 
additional marks awarded for the covering letter. 
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7 Sales system 


Stage1 


Stage 2 


Stage 3 


Stage 4 


Stage 5 


Order received 


Transactions recorded in 


Cash received 


Objectives 
The objectives of controls in the sales system are to ensure that: 
Stage Objective 
Ordering e Goods are only supplied to customers who pay 
promptly and in full. 
. All orders are processed. 
Despatch e Orders are despatched promptly and in full to the 
correct customer. 
. All orders are despatched. 
Invoicing . All goods despatched are invoiced. 
. Invoices are raised accurately. 
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Recording e Only valid sales are recorded. 
. All sales and related receivables are recorded and 
in the correct accounts. 
. Revenue is recorded in the period to which it 
relates. 
. Sales are recorded accurately and related 
receivables are recorded at an appropriate value. 
Cash received e Cash received is allocated against the correct 
customer and invoices to minimise disputes. 
. Overdue debts are followed up on a timely basis. 
. Irrecoverable debts are identified and written off 
appropriately. 


Test your understanding 1 


Murray case study: Sales cycle 
Ordering 


For all new customers, a sales manager completes a credit application 
which is checked with a credit agency and a credit limit is entered into 
the sales system by the credit controller. Credit checks are not 
reperformed unless a customer requests an increase to their credit limit. 
If an increase is requested, a new check will be performed and the credit 
limit revised. 


The orders are entered into the sales system by a sales assistant. After 
the order has been accepted, the sales assistant checks that the goods 
are available and that the order will not take the customer over their 
credit limit. 


Goods despatch 


When the warehouse receives the order, a goods despatch note (GDN) 
is generated and a member of the warehouse team packs the goods 
using the GDN. A second member of the team double checks the details 
on the GDN to the goods packed, signing the GDN to evidence the 
check. 


Four copies of the GDN are produced. One copy is sent with the goods 
and retained by the customer. A second is sent with the goods, signed 
by the customer and returned to Murray Co to confirm receipt of the 
goods which is filed in the warehouse. A third copy is sent to the sales 
team who update the system and the fourth copy is sent to the accounts 
department. 
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Invoicing 


Sales invoices are raised by the accounts department using the GDNs. 
Sales invoices are not sequentially numbered, and no review is 
performed to ensure all goods have been invoiced. 


Sales invoices are prepared using the approved company price list, 
which is updated quarterly. Payment terms are stated on the sales 
invoice and all customers have 10 days to pay their invoice. 


Discounts must be requested by a sales manager and authorised by the 
sales director to allow the accounts team to raise an invoice. 


Recording transaction 


The list of individual customers is reviewed for credit balances by the 
senior accountant on a monthly basis and reconciled with the trade 
receivables account when the sales ledger manager has time. Monthly 
customer statements are sent to customers. 


Cash receipt 


Receipts are counted by the office assistant, recorded by the cashier in 
the bank ledger account, and the sales ledger clerk is notified of the 
receipt. The sales ledger clerk agrees the amount received to the 
amount invoiced and marks the invoice as paid. 


The credit controller reviews the aged receivables analysis on a 
fortnightly basis to assess the level of slow-moving debts and an 
allowance is made for any debts which are considered doubtful. Debts 
which are more than six-months overdue are chased up. 


Required: 
In respect of the sales system of Murray Co: 


(a) (i) Identify and explain FIVE DIRECT CONTROLS which the 
auditor may seek to place reliance on; and 


(ii) Describe a TEST OF CONTROL the auditor should 
perform to assess if each of these controls is operating 
effectively. 


Note: Prepare your answer using two columns headed Direct 
control and Test of control respectively. (10 marks) 


(b) Identify and explain FIVE DEFICIENCIES and provide a 
recommendation to address each of these deficiencies. 


Note: Prepare your answer using two columns headed Control 
deficiencies and Control recommendation respectively. (10 marks) 


(Total: 20 marks) 
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e.g] 
The key document in the sales cycle is the goods despatch note: 
Murray Co Goods Despatch Note 
"Supplying Equipment to the Sporting Nation" Ref: AB123456MC 
Www.murraysports.com 
Murray Co 
1 Murray Mound, 
Wimbledon, London 
WN1 2LN 
Destination 
Customer Ref: W004 Order Number: 
Customer Name: Winners Co ZY987654WS 
Customer Address: 2 Edinburgh St, 
Dunblaine, Scotland DL2 2ES 
Quantity 
Quality and 
> Product RT i quantity of 
Line Number Description Quantity goods 
checked 
and agreed 
001 4378493729 Tennis racket 24 Yes 
002 3257845743 Tennis balls (packs 6 Yes 
of 6) 
003 4357849574 Tennis court net 3 Yes 
004 3473895789 Tennis 3 Yes 
scoreboard 
005 4574895743 Winner's trophy 1 Yes 
006 3457435437 Runner-up 1 Yes 
trophy 
007 4830998543 Participant's medal 24 Yes 
Signed: 
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8 Purchase system 


Stage 1 


Stage 2 


Stage 3 


Stage 4 


Stage 5 


Objectives 


Orders placed 


Transactions recorded in 
books 


Cash payments 


The objectives of controls in the purchases system are to ensure that: 


Stage 


Objective 


Ordering 


. All purchases are made with suppliers who have 
been checked for quality, reliability and pricing. 


. Purchases are only made for a valid business use. 


. Orders are placed taking consideration of delivery 
lead times to avoid disruption to the business. 


Goods received 


. Only goods ordered by the company are accepted. 


. Goods received are recorded promptly. 


Invoice received 


. Invoices received relate to goods actually received. 
. Invoices received relate to the company. 
. Invoices received are correct in terms of quantities, 


prices, discounts. 
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Recording . All purchases and related payables are recorded. 


. Purchases are recorded accurately and related 
payables are recorded at an appropriate value. 


. Purchases are recorded in the period to which they 
relate. 


. Purchases and payables are recorded in the 
correct accounts. 


Cash 


payments . Payments are only made for goods received. 


. Payments are only made once. 


. All payments are made on time. 


al 


Test your understanding 2 


Murray case study: Purchases cycle 


Ordering 


Goods or services are obtained by placing a purchase requisition with 
the centralised purchasing department. Requisitions are sequentially 
pre-numbered and a weekly sequence check is performed. All requisitions 
must be authorised by an appropriate manager. 


On receipt of a purchase requisition, a purchase officer agrees the 
manager's signature to the signatory list held on file and checks 
inventory levels where appropriate. Orders are placed with suppliers 
using sequentially pre-numbered purchase orders. 


Orders can only be placed with suppliers from the approved supplier list. 
Suppliers can only be added to the approved suppliers list by the 
procurement team once the terms of the contract have been agreed, 
and references obtained. Written confirmation is requested for all orders 
placed, and the purchase officer agrees the quoted price against the 
agreed price list and ensures any bulk discounts to which Murray Co is 
entitled, have been honoured. 


G 


Goods are received into the central warehouse. Goods are inspected for 
condition and quantity by a warehouse operative, and agreed to the 
purchase order before the supplier's delivery note is signed to accept 
the goods. 


A sequentially pre-numbered goods received note (GRN) is prepared by 
the warehouse team manager, and grid-stamped. The grid stamp is 
signed by the warehouse operative to confirm that the goods have been 
inspected for condition and quantity and agreed to the purchase order. 
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The warehouse manager updates the inventory system on a daily basis 
from the prepared GRNs. The warehouse manager checks the 
sequence of purchase orders received on a weekly basis and informs 
the purchasing department of any missing orders so that they can be 
followed up. 


On receipt of an invoice by the head office accounts team, the invoice is 
matched to and filed with the relevant GRN, using the purchase order 
number marked on the invoice (if there is no purchase order number 
marked on the invoice, this must be obtained from the supplier). The 
invoice number is noted on the GRN grid stamp. The invoice is also 
checked to the original purchase order to ensure the agreed prices and 
discounts have been honoured. 


A monthly check of GRNs is made by the purchase ledger manager, to 
identify any GRNs for which no invoice has been received. 


Recording transaction 


The purchase ledger clerk enters invoices into the system in batches. 
A batch control sheet is used, which details the number of invoices and 
the total value. These details are checked to the system batch report. 


Each invoice is stamped as ‘recorded’ once the details have been 
entered into the system. The purchase ledger manager inspects the file 
of invoices on a monthly basis to ensure that all invoices have been 
recorded. 


Suppliers are required to submit monthly supplier statements, which are 
reconciled to the individual supplier's account by the purchase ledger 
manager. The list of individual suppliers is reconciled to the trade 
payables account on a monthly basis by the purchase ledger manager, 
and reviewed by the company accountant. 


Cash payment 


The list of payments is sent to the company accountant, who agrees the 
details of each payment to the relevant invoice and signs each invoice 
to authorise payment and evidence the check. The list of payments is 
signed by the accountant once all invoices have been checked, and 
sent to the cashier's office for payment. 


If any individual payment is for more than $25,000 or total payments are 
for more than $250,000 a second signatory is required. These payments 
must also be checked and signed by either the financial controller, or 
finance director. 
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Payments are made by the cashier's office by bank transfer. Invoices 
are stamped as ‘paid’, and returned to the purchase ledger team who 
record the payment and file the invoices (separately from invoices not 
yet paid). 


The purchase ledger manager checks GRNs on a monthly basis to 
ensure that invoices have been received and paid on a timely basis. 
Required: 

In respect of the purchases system for Murray Co: 


(i) Identify and explain TEN DIRECT CONTROLS which the 
auditor may seek to place reliance on; and 


(ii) Describe a TEST OF CONTROL the auditor should perform to 
assess if each of these controls is operating effectively. 


Note: Prepare your answer using two columns headed Direct control 
and Test of control respectively. 


(20 marks) 


The key document in the purchases cycle is the goods received note: 
Murray Co 

Goods Received Note: A2012/123478 

Purchase Order number: MC/34324832809/RC 

Date of receipt: 31st August 20X4 

Time of receipt: 12:48pm 


Description Quantity Quantity Quality of goods 
ordered received checked 
Vectran 75kg 75kg Yes 


Sign to confirm quantity and quality of goods checked: 


Warehouse Operative 


Invoice number: 
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Fraud is specifically designed to mislead people. Consider the following 
example: 


A company only deals with suppliers on a list authorised by the 
finance director (FD). 


Payments to suppliers are made after the purchases clerk 
identifies the monthly payments to be made and prepares the 
cheques. 


The cheques are signed by the FD, who confirms the amounts 
paid and supplier names to supporting documentation. 


The cheques are countersigned by the managing director, who 
does not check the details but has a good knowledge of who the 
suppliers are. 


This appears like a sensible combination of authorisation controls 
and segregation of duties. The auditor would place reliance on the 
control system and reduce substantive testing of purchases. 


However, now consider the implication if one of the suppliers is actually 
controlled by the FD. The supplier regularly overcharges the company 
and the purchases clerk is being bribed by the FD in return for their 
silence. 


It is for this reason that the auditor must always perform some 
substantive procedures and must always maintain an attitude of 
professional scepticism. 
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Non-current assets 


Expenditure on non-current assets should be controlled in a similar way 
to other purchases. However, because of the significant amounts 
involved, additional controls should be in place. 


Control objectives 

. Assets are only purchased if there is a business need. 

. Assets are purchased at an appropriate price. 

. The company can afford the asset expenditure proposed. 


. Asset expenditure is appropriately treated in the accounting 
records. 


. Asset expenditure is completely and accurately recorded in the 
accounting records. 


. Assets are covered by adequate insurance to prevent loss to the 


company. 
. Documents relating to assets are safeguarded from theft or 
damage. 
Control Test of control 


Requisitions for asset expenditure 
should be made by an 
appropriate person. 


Inspect the requisition for the 
signature of the person 
requisitioning the assets. 


Ensure this is a person of suitable 
authority by agreeing the name to 
a list of people authorised to 
make such requisitions. 


Authorisation for purchases of 
non-current assets should be at a 
more senior level. 


Inspect the purchase order for 
signature of appropriate senior 
person(s). 


Several quotations should be Inspect the purchase requisition 


obtained before purchase in order 
to obtain the best price. 


for the quotations to ensure they 
have been obtained. 
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An annual asset expenditure 
budget for each department 
should be prepared and 
authorisation should only be 
given for purchases which have 
been budgeted. 


nspect the annual budget to 
ensure it has been prepared. 


nspect board minutes to confirm 
the budget has been approved by 
the board. 


nspect orders for asset 
expenditure items to ensure they 
have been authorised by a 
responsible official. 


Regular review of repairs and 
maintenance expenditure should 
be performed to ensure items 
which should be capitalised have 
not been expensed in error. 


nspect management accounts/ 
ist of repairs and maintenance 
expenditure for evidence of 
review. Enquire of management 
how discrepancies are dealt with. 


A regular reconciliation of the 
asset register to the physical 
assets held should be performed. 


nspect the reconciliation of the 
asset register and evidence of 
approval by a senior person to 
ensure the reconciliation has 
been performed correctly. 


An asset register should be 
maintained which includes cost, 
depreciation, location, responsible 
employee, insurance details, etc. 


nspect the asset register to 
ensure details expected to be 
recorded have been recorded to 
ensure good control is maintained 
over assets. 


Adequate insurance cover should 
be purchased. 


Inspect insurance policies to 
ensure they are in place. Review 
the policies to ascertain the level 
of cover in place and compare 
this with the value of assets to 
ensure it is sufficient. 


Documentation such as title 
deeds, vehicle registration 
documents, insurance policies, 
etc. should be stored in a secure, 
fire-proof location. 


Inspect the storage facilities for 
important documentation to 
ensure it is appropriately secure 
and adequate backups have been 
maintained in case of a fire or 
flood. 
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9 Payroll system 


Stage 1 Clock cards submitted 
and input 
Stage 2 Gross pay, deductions 
and net pay calculated 
Stage 3 Other AE 
Stage 4 Final payroll calculated 


and payslips produced 


Payments to employees 


Stages and tax authorities 


weccccccccccces 


Stage 6 Payroll costs and 


payments recorded 
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Objectives 


The objectives of controls in the payroll system are to ensure that: 


Stage 


Objective 


Clock cards (or timesheets) 
submitted. 


Employees are only paid for work 
actually done. 


Payroll calculation 


Only genuine employees are paid. 


Employees are paid at the correct 
rates of pay. 


Gross pay is calculated and 
recorded accurately. 


Net pay is calculated and recorded 
accurately. 


Standing data amendments 


Standing data is kept up to date. 


Access to standing data is restricted 
o prevent fraud or error occurring. 


Recording 


All payroll amounts are recorded. 


Payroll amounts are recorded 
accurately. 


Payroll costs are recorded in the 
period to which they relate. 


Payments to employees and tax 
authorities 


Correct amounts are paid to the 
employees and taxation authorities. 


Payments are made on time. 


Payments are only made to valid 
employees. 
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Murray case study: Payroll cycle 


Standing data eer 


The company’s HR department is responsible for processing starters 
and leavers. A copy of the starter’s and leaver’s forms are sent to the 
payroll department so the payroll system can be updated. 


Non-production staff are paid a salary which increases by the rate of 
inflation each year. The payroll clerk is responsible for updating the 
standing data in the payroll system. 


The payroll system has the functionality to produce an exception report 
detailing changes to the payroll standing data but this function is not 
currently utilised. 


Clock cards submitted and input 


Production workers are paid according to the number of hours worked. 
They are required to record their times of arrival and departure at the 
factory using a clock card which is inserted in a time recording clock. 
The clocking-in process is not monitored. 


On a weekly basis the cards are collected and passed to the works 
office where the clerk totals up the hours worked on each card and lists 
the total hours worked (a ‘hash’ total). The cards and the total hour's list 
are then passed to the payroll clerk who enters the hours worked into 
the payroll system and agrees the total entered. 


Payroll calculations 


The payroll system automatically calculates the gross and net pay along 
with relevant deductions for both the production and non-production 
employees. These calculations are not checked. The payroll report is 
passed to the payroll clerk who creates a payment list detailing the 
payments to be made to the employees and the taxation authority. 


Payments to employees 


The majority of employees are paid by bank transfer. The payroll 
manager reviews the list of bank payments and agrees this to the payroll 
records. If any discrepancies are noted, the payroll manager always 
makes the adjustment in the payroll records. 
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Some employees are paid in cash at the employees’ request e.g. if the 
employee does not have a bank account. Two members of the payroll 
department produce the pay packets, one is responsible for preparing 
them and the other checks the finished pay packets. Both members of 
staff are required to sign the payroll listing on completion of this task. 
Prepared pay packets are sent to the employee’s supervisor, who 
distributes them to the employee at the end of their shift. Employees do 
not have to sign anything to confirm they have received their pay 
packet. 


Payroll costs and payments recorded 


A copy of the payroll list is sent to the finance department who record 
the payroll expense and payments made. 


Each month, as part of the month-end procedures, a payroll account 
reconciliation is performed by the financial controller to ensure that the 
payroll figures have been posted into the accounting records correctly. 
The reconciliation is not reviewed. 


Required: 


Identify and explain SIX deficiencies in Murray Co’s payroll system 
and provide a control recommendation to address each of these 
deficiencies. 


Note: Prepare your answer using two columns headed Control 
deficiency and Recommendation respectively. 


(12 marks) 


Inventory system 


Goods Goods 
Stage 1 received despatched 
Stage 2 Receipt Despatch 
recorded recorded 
Stage 3 Movements posted 


to inventory ledger 
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Objectives 


The objectives of controls in the inventory system are to ensure that: 


Inventory levels meet the needs of production (raw materials and 
components) and customer demand (finished goods). 


Inventory levels are not excessive, preventing obsolescence and 


unnecessary storage costs. 


Inventory is safeguarded from theft, loss or damage. 


Inventory received and despatched is recorded on a timely basis. 


All inventory is recorded. 


Inventory should be recorded at the appropriate value. 


Only inventory owned by the company is recorded. 


The following controls over inventory relate to the period after purchase and 
before sale i.e. when the goods are being stored in the warehouse. 


Control 


Test of control 


Inventory should be maintained at an 
appropriate level through the use of 
automatic ordering systems when 
inventory reaches a certain level or 
by checking inventory levels before 
orders are placed. 


Using test data, place an order which 
will reduce inventory of an item to 
below the reorder level and trace 
through the system to see if an order 
is automatically generated. 


Observe the ordering clerk checking 
inventory levels before placing an 
order. 


Inventory should be kept in a 
warehouse with access restricted to 
warehouse staff by the use of swipe 
card or keypad access. 


CCTV should be in place to monitor 
people around the entrance to the 
warehouse to ensure people do not 
follow other people into the 
warehouse without the need for a 
code/swipe card. 


Visit the warehouse and attempt to 
enter. Ensure that doors are kept 
closed requiring the swipe card or 
code to gain access. 


Inspect the warehouse area to see 
the CCTV in place and visit the 
location of the camera feed to ensure 
the cameras are monitored. 


Inventory should be kept in 
appropriate conditions e.g. 
temperature-controlled environment 
for perishable items. 


Visit the warehouse and inspect the 
conditions of storage. Inspect 
evidence of monitoring the conditions 
on a regular basis such as 
temperature logs. 
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Fire/smoke/heat detectors and 
sprinkler systems should be in place 
to reduce the risk of damage caused 
by fire. 


Inspect the warehouse to see the 
detectors and sprinkler systems are 
in place. 


Inspect certificates confirming they 
have been checked and tested on a 
regular basis. 


Inventory should be insured in case 
of theft or damage. 


Inspect insurance policies to ensure 
they cover inventory, that adequate 
cover is in place by comparing 
against inventory value, and that the 
policy has not lapsed. 


Inventory movements should be 
recorded in the system promptly 
using the GRNs and GDNs. The 
GRNs and GDNs should be stamped 
to confirm they have been input and 
the system is up to date. 


Inspect the GRNs and GDNs to see 
they have been stamped as entered 
into the system. 


Compare the date on the stamp to 
the date on the GRN/GDN to ensure 
they have been entered promptly. 


Inventory counts should take place on 
a regular basis so that physical 
inventory quantities can be reconciled 
with the accounting system ona 
regular basis to ensure the records 
are accurate and up to date. 


Obtain inventory counting instructions 
and review to ensure the count will be 
appropriately organised and 
controlled. 


Attend the inventory count to ensure 
the count is carried out in accordance 
with the instructions and perform test 
counts to ensure the client's counts 
are carried out accurately. 


Inventory should be reviewed during 
the count for damage or 
obsolescence and valued separately 
from the other inventory by making an 
allowance to write the inventory down 
to net realisable value. 


During the count, review the inventory 
to ensure damaged or obsolete items 
are separately identified. 


See the ‘Procedures’ chapter for detailed controls over inventory counts. 
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11 Bank and cash system 


7 
Stage 1 Request for payment 


Stage 2 Payment authorisation 


Payment 


ateges made 


Receipts 


Stage 4 Payments and receipts 
recorded 


Objectives 


The objectives of controls in the cash cycle are to ensure that: 


. Petty cash levels are kept to a minimum, preventing theft. 


. Payments can only be made for legitimate business expenditure. 


. Cash can only be withdrawn for business purposes. 


. Cash is safeguarded to prevent theft. 


. Receipts are banked on a timely basis to prevent theft. 


. Cash movements are recorded on a timely basis. 


The following controls over cash relate to the period after receipt from a 


customer and before being used to pay 


or expenses. In addition, there should 


be adequate controls over access to cash and bank records. 


Control 


Test of control 


An imprest system of petty cash 
should be used for items of 
expenditure less than $x. All other 
reimbursements should be made 
through an expense claim and 
processed as a bank payment. 


In the presence of the client, count 
the petty cash to ascertain that the 
level is at the limit set. Inspect the 
petty cash vouchers to ensure 
amounts reimbursed are below the 


limit stated. 
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Petty cash reimbursements must be 
supported by an invoice to confirm 
the expenditure was incurred and is 
business related before being 
authorised and paid. 


Inspect the petty cash 
reimbursements for the supporting 
invoice and the signature of the 
person authorising the 
reimbursement. 


Cash withdrawals must be authorised 
by a manager. 


Inspect the withdrawal request for 
evidence of the manager's signature 
authorising that the money can be 
taken out of the bank. 


Cash and cheque books should be 
stored in a locked safe with restricted 
access. 


In the presence of the client, inspect 
where the cash and cheque books 
are stored to ensure they are secure, 
e.g. within a safe. 


Enquire of management who has 
access to the safe to ensure this is 
restricted to people with suitable 
seniority. 


Controls over bank transfers and 
online banking should be in place, 
e.g. secure passwords and PINs. 


Enquire of management who has 
access to the online banking system. 


Inspect transactions in the banking 
system for the username of the 
person initiating and authorising 
transactions to ensure this 
corroborates what has been said. 
Assess whether the person 
authorising the transactions is of 
suitable seniority. 


Cash and cheques received should 
be banked frequently. 


Inspect the paying in books or bank 

statements to identify how frequently 
deposits are paid in to ensure this is 
adequate. 


Bank reconciliations should be 
prepared on a regular basis 

(e.g. weekly) and reviewed by a 
responsible official to confirm it has 
been reconciled properly. 


Inspect the file of bank reconciliations 
to ensure they are performed 
regularly. Inspect the reconciliation 
for a manager's signature as 
evidence it has been reviewed and 
approved. Reperform the 
reconciliation to ensure it has been 
carried out effectively. 
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Exam question approach 


The exam is likely to include one, or both, of the following requirements: 


. Identify and explain the control deficiencies from the scenario 
and provide recommendations to overcome the deficiencies. 


. Identify and explain the direct controls from the scenario and 
describe tests of controls the auditor would perform to obtain 
evidence that the control is working effectively. 


Control deficiencies 


Identification of the deficiencies is usually quite straightforward. You 
should look for information which indicates: 


. Controls are missing e.g. Sales orders are not sequentially 
numbered. 


. Controls are not effective e.g. Bank reconciliations are supposed 
to be performed but often don’t get done due to lack of time. 


Work with the information provided. Do not assume that because 
something isn’t mentioned it isn’t happening. 


Explanation of the deficiency requires you to explain the implication for 
the company or a risk of misstatement in the accounting records. It is 
not an explanation if you only say this should not be done or this should 
be done. You must explain what the control would achieve if it was in 
place and working effectively. The explanation needs to be sufficiently 
detailed. If you only explain the deficiency in part you will not earn the 
explanation marks. 


Recommendation 


For the recommendation, suggest the control procedure which needs to 
be implemented. This also needs to be sufficiently detailed. Try and 
recommend which person within the company should perform the 
control and how frequently. Sometimes a control requires more than one 
element to be effective, therefore make sure you suggest everything 
that needs to happen to make the control effective. 
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Control deficiency 


Recommendation 


Poor Sales orders are not Orders should be 

answer sequentially numbered. sequentially numbered. 
Deficiency is not explained. | Recommendation is not 
Why does it matter if the sufficiently detailed. How 
sales orders are not does the client know the 
sequentially numbered? sequence is complete? 

Better Sales orders are not Orders should be 

answer sequentially numbered. sequentially numbered. 
Orders will be difficult to A sequence check 
trace and orders may not be | should be performed and 
fulfilled. any breaks in the 
Deficiency is still not fully sequence investigated 
explained. and resolved. 
What are the consequences | Recommendation is now 
to the company if it has sufficiently detailed. 
unfulfilled orders? 

Good Sales orders are not Orders should be 

answer sequentially numbered. sequentially numbered. 


Sales orders may not be 
completely recorded 
resulting in unfulfilled orders. 
Orders received but not 
recorded will be difficult to 
trace. 


Customers will be 
dissatisfied if orders are not 
fulfilled resulting in 
complaints and loss of future 
revenue. 


A sequence check 
should be performed and 
any breaks in the 
sequence investigated 
and resolved. 
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Control deficiency 


Recommendation 


Poor 
answer 


Bank reconciliations are 
supposed to be 
performed but often don’t 
get done due to lack of 
time. 


Deficiency is not 
explained. Why does it 
matter if the bank 
reconciliation does not 
get performed? 


Bank reconciliations 
should be performed. 


Recommendation is not 
sufficiently detailed. Who 
should perform the bank 
reconciliation? 

How often should it be 
performed? 

How does management 
know it has actually been 
done? 


Better 
answer 


Bank reconciliations are 
supposed to be 
performed but often don’t 
get done due to lack of 
time. 


Errors could occur. 


Deficiency is still not fully 
explained. 
Errors in what? 


Bank reconciliations 
should be performed 
weekly. 


Recommendation is 
slightly better but is still 
not sufficiently detailed. 


Good 
answer 


Bank reconciliations are 
supposed to be 
performed but often don’t 
get done due to lack of 
time. 


Errors could occur. 


The bank ledger account 
may be incorrect resulting 
in misstatement of the 
bank and cash figure in 
the financial statements. 


Bank reconciliations 
should be performed on a 
weekly basis by someone 
independent of 
maintaining the bank 
ledger account and the 
reconciliation should be 
reviewed by a responsible 
official. 
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Direct controls 


Direct controls are control procedures which are properly designed, in 
place and working effectively at addressing the risk of material 
misstatement at the assertion level. 


Read the scenario and look for mention of controls such as 
reconciliations being performed, authorisation of transactions, 
segregation of duties, restricted access to valuable items, etc. 


A control is an activity that is performed in addition to the normal 
processing of the system, to ensure that the system has operated as it 
should. For example, raising a sales invoice is part of a normal sales 
system, it is not a control. A control would be someone performing a 
check to confirm the sales invoice had been raised accurately, or 
someone performing a check to confirm completeness of sales invoices 
in relation to GDNs. A control to confirm accuracy of invoices might be 
a sales manager agreeing the price on the invoice to the company’s 
authorised price list and recalculating the invoices to confirm accuracy 
before they are sent to the customer. A control to confirm completeness 
of sales invoices might be that sales invoices are matched to GDNs and 
every week a sales manager performs a review of sales invoices to 
identify any unmatched invoices which are then investigated. 


Make sure that there is nothing mentioned which would make the 
control ineffective. For example, duties may be segregated between 
two individuals who are related. This increases the risk of collusion 
which negates the control. Reconciliations might be performed 
infrequently and not reviewed by anyone. Therefore, the control is 
ineffective as it is not being performed all of the time, and no-one is 
checking that it has been performed correctly. 


Tests of controls 


A test of control is an audit procedure which will provide evidence as to 
whether the control procedure is in place and working effectively. 


The focus of a test of control is the control procedure. If a direct control 
identified is segregation of duties between calculating payroll and 
making the payroll payment, the auditor will need to obtain evidence 
that these duties are segregated e.g. by observing the procedures and 
inspecting procedures documents and organisation charts to ensure 
different people are responsible for each task. 


Tests of controls are not substantive procedures. Therefore, when 
testing the control, the auditor does not need to test the balance which 
will go into the financial statements. 
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Direct control 


Test of control 


Poor GDNs are matched to Agree the amount 
answer sales invoices. recorded on the sales 
invoice and GDN to the 
detailed sales listing. 
This is a substantive 
There is no explanation of | procedure, not a test of 
the control objective. control. The objective of a 
test of control is to 
confirm the control is in 
place, i.e. that the GDNs 
are matched to the sales 
invoices. 
Better GDNs are matched to Inspect the GDNs and 
answer sales invoices. sales invoices. 
This reduces the risk of 
errors. 
The test of control does 
The control explanation is | not explain the objective 
too vague. Reduces the of the test. What are we 
risk of errors in what? inspecting the GDNs and 
invoices for? 
Good GDNs are matched to Inspect a sample of 
answer sales invoices by a GDNs and related 


finance clerk and signed 
to confirm the matching 
has been performed. 


This ensures the 
customer is invoiced for 
the correct goods which 
will reduce the risk of 
disputes and ensure 
sales are recorded 
accurately. 


invoices to confirm the 
details match and inspect 
for evidence of the 
finance clerk’s signature 
confirming the matching 
has been performed. 
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Rhapsody Co supplies a wide range of garden and agricultural products 
o trade and domestic customers. The company has 11 divisions, with 
each division specialising in the sale of specific products, for example, 
seeds, garden furniture, and agricultural fertilizers. The company has an 
internal audit department which provides reports to the audit committee 
on each division on a rotational basis. 


Products in the seed division are offered for sale to domestic customers 
via an Internet site. Customers review the product list on the Internet 
and place orders for packets of seeds using specific product codes, 
along with their credit card details, onto Rhapsody Co's secure server. 
Order quantities are normally between one and three packets for each 
type of seed. Order details are transferred manually into the company's 
internal inventory control and sales system and a two-part packing list is 
printed in the seed warehouse. Each order and packing list is given a 
random alphabetical code based on the name of the employee inputting 
the order, the date and the products being ordered. 


In the seed warehouse, the packets of seeds for each order are taken 
from specific bins and despatched to the customer with one copy of the 
packing list. The second copy of the packing list is sent to the accounts 
department where the inventory and sales computer is updated to show 
that the order has been despatched. The customer's credit card is then 
charged by the inventory control and sales computer. Irrecoverable 
receivables in Rhapsody Co are currently 3% of the total sales. 


The computer system checks that for each charge made to a customer's 
credit card account, the order details are on file to prove that the charge 
was made correctly. 

Required: 

In respect of sales in the seeds division of Rhapsody Co: 

(i) Explain FOUR deficiencies in the sales system, and 


(ii) For each deficiency provide a recommendation to overcome 
that deficiency. 


Note: Prepare your answer using two columns headed Control 
deficiency and Control recommendation respectively. 


(8 marks) 
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Test your understanding 5 


Whilst performing tests of controls, many control deviations were found. 
The auditor has therefore concluded that reliance cannot be placed on 
the internal controls. 

Required: 


Explain THREE actions that the auditor may now take in response 
to this problem. 


(3 marks) 


Test your understanding 6 


(a) Define ‘tests of control’ and explain the importance of tests of 
control in the audit of a company. 


(2 marks) 


(b) You are an audit senior working at a medium sized firm of auditors. 
One of your clients, Numero Uno, is an exclusive hotel situated in 
the centre of Big City. As part of your audit procedures, you are 
assessing the controls surrounding payroll. You have read last 
year’s audit file and have obtained the following information: 


The hotel employs both full and part time staff. Due to the nature of 
the business most of the work is done in shifts. All staff are paid on 
a monthly basis. 


New members of staff are given an electronic photo identification 
card on the day they join by the personnel department. This card is 
used to ‘clock in’ and ‘clock out’ at the start and end of the shift to 
record the hours worked. 


At the end of each week the information recorded on the system is 
sent automatically to the payroll department and also to the head 
of each of the three main operating divisions: Rooms, Food & 
Beverage and Corporate Events. Each head of division must reply 
to the payroll department by email to authorise the hours worked 
by their staff. 


The payroll clerk collates all the authorised information and inputs 
the hours worked into a standardised computerised payroll 
package. This system is password protected using an 
alphanumerical password that is only known to the payroll clerk 
and the finance manager. 


KAPLAN PUBLISHING 


289 


Systems and controls 


Once the hours have been entered, the calculations of gross pay 
and taxation are calculated automatically along with any other 
statutory deductions. Once calculated, a payroll report is produced 
and printed. The finance manager reviews the report and 
compares the data to last month to identify and follow up any 
unusual variances. Once satisfied with the information, the finance 
manager authorises the payroll run by signing the payroll report 
and the payroll clerk submits the data. 


Payslips are sent to the home address of each employee and 
payment is made by bank transfer. 

Required: 

In respect of the payroll system for Numero Uno: 


(i) Identify and explain FOUR DIRECT CONTROLS which the 
auditor may seek to place reliance on; and 


(ii) Describe a TEST OF CONTROL the auditor should perform to 
assess if each of these controls is operating effectively. 


Note: Prepare your answer using two columns headed Direct control 
and Test of control respectively. 


(8 marks) 
(Total: 10 marks) 


TI Test your understanding 7 


You are testing the controls over the payroll system of Bunbury Co. You 
have confirmed that the following controls have operated throughout the 
year: 


. Sample check of payroll calculations by a payroll manager. 


. Review of the payroll listing once prepared before details are 
entered into the banking system. 


. Segregation of duties between calculation of monthly payroll and 
responsibility for changes to standing data. 


. Each department manager receives a list of employees in their 
department for them to sign to confirm those employees should be 
paid. 
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Which of the following is the main reason for the control of 
segregation of duties between calculation of payroll and 
responsibility for changes to standing data? 


A Changes to standing data must be performed by a manager 
whereas payroll calculations can be performed by a payroll 
clerk 


B If one person was responsible for both they would be more 
likely to make errors due to a high workload 


C If one person was responsible for both they could increase 
their salary and make fraudulent payments to themselves 


D Each individual role within an organisation must be carried 
out by different people 


Which of the following procedures would provide the most 
reliable evidence that the first control, payroll calculations 
are checked by a payroll manager, is working effectively? 


A Enquiry with the payroll clerk performing the payroll 
calculation 


B Enquiry with the payroll manager performing the check 
C Recalculation of the payroll amounts by the auditor 


D Inspection of the payroll report for evidence that a sample of 
payroll amounts are checked 


Which of the following is NOT a test of control? 


A Inspection of employee contracts to confirm the salary the 
employee should be paid 


B Inspection of payroll reports for evidence of authorisation by 
the manager 


C Inspection of the list of employees for each department for 
evidence of the department manager's review 


D Observation of the payroll function to confirm segregation of 
duties is in place 


Which of the following is a control objective relevant to the 
control that each department manager reviews the list of 
employees? 


A To ensure payroll is accurately calculated 

B To ensure only valid employees are paid 

C To ensure employees are paid for the correct hours 
D 


To ensure employees are paid at the correct salary 
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Which of the following could be used by Bunbury Co to 


monitor the effectiveness of the company's controls? 


A 


B 
Cc 
D 


Internal audit assignments 
Performing bank reconciliations 
Authorisation of payments 
Segregation of duties 


Test your understanding 8 


You are performing the risk assessment for the audit of Kununurra Co, a 
client your firm has audited for the past two years. From your review of 
last year's audit file you have found that no significant control 
deficiencies were identified. The systems are documented on the 
permanent audit file in the form of flow charts and narrative notes. 


1 Which of the following best describes the requirement of the 
auditor in respect of the controls documentation? 


A 


B 


D 


The auditor must document the systems this year as they 
may have changed since last year 


The auditor may enquire whether the systems have changed 
since last year, and if not, no further work is necessary 


The auditor must perform procedures to ensure the systems 
work as documented on file e.g. by performing walkthrough 
tests 


No work is necessary on systems documentation unless the 
client informs the auditor that changes have occurred 


2 Which of the following best describes the auditor's approach 
in respect of reliance on internal controls? 


A 


B 


Tests of controls must be performed over material areas of 
the financial statements 


Tests of controls must be performed each year over areas of 
significant risk where the auditor is hoping to place reliance 
on controls 


Tests of controls are not necessary this year as no 
deficiencies were identified last year 


Tests of controls must be performed over all areas 
irrespective of whether the auditor is planning to place 
reliance on those controls 


KAPLAN PUBLISHING 


Chapter 8 


A 


B 


(03 


D 


3 Which of the following questions would NOT be included in an 
internal control evaluation questionnaire? 


How does the company ensure sales are only made to 
creditworthy customers? 


How does the company ensure that purchases are only made 
for a valid business use? 


How does the company ensure that all purchases are 
recorded? 


Is access to the warehouse restricted to authorised personnel 
only? 


4 Internal controls should be monitored on an ongoing basis to 
ensure they are adequate, relevant and working effectively. 
Which of the following will NOT monitor the internal controls of 


a company? 

A External auditor 

B Management 

C Consultancy firm hired by management 
D Internal auditor 


5 Match the description to the appropriate method of 
documenting a control system. 


A diagram depicting the 


controls in place at each stage | ICQ/ICE | Flowchart gers 
of a process 
A disadvantage of this method Narrative 
may be that controls are ICQ/ICE | Flowchart 

notes 
overstated 
An advantage of this method 
is that they are easy to Narrative 


ICQ/ICE | Flowchart 


prepare in advance and notes 
therefore efficient 


For larger systems this 
method may be time 


consuming and it may be ICQIICE | Flowchart Narrative 
difficult to identify missing 
controls 
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12 Chapter summary 


SYSTEMS AND CONTROLS 
Revenue 
Purchases 
Payroll 
Inventory 
Cash and bank 
Non-current assets 


UNDERSTAND THE COMPONENTS. 
OF THE CONTROL SYSTEM 
Control environment 
Risk assessment process 
Information systems 
Control activities 
Monitoring 


DOCUMENT THE SYSTEMS 
e Narrative notes 

e Flowcharts 

e ICQs 

e Organisation charts 


TEST THE SYSTEMS 
e Tests of controls 
e Test data 


COMMUNICATE DEFICIENCIES 
e All deficiencies to 
management 
Significant deficiencies 
to TCWG 


CONTROL ACTIVITIES 


Authorisation 
Reconciliations 
Verifications 

Physical or logical controls 
Segregation of duties 
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Test your understanding answers 


Test your understanding 1 


(a) Direct controls and tests of control 


Direct control 


Test of control 


Credit checks are performed and 
credit limits set: sales are only 
made to customers that are likely 
to make a full and prompt 
payment, reducing the risk of 
irrecoverable debts. 


Irrecoverable debts will reduce 
profit and cash inflows and if not 
written off will result in 
overstatement of receivables. 


Inspect a sample of customer 
files to ensure a credit check has 
been performed. 


Inspect the customer's account 
within the system to ensure credit 
limits have been put in place. 


A second member of the 
warehouse team checks the 
goods packed, signing the GDN 
o evidence the check: 
segregation of duties. 


Segregation of duties reduces 
he risk of theft and fraud which 
results in loss for the company 
and potential misstatements in 
he accounting records. 


Visit a warehouse and observe 
the goods despatch process to 
assess whether all goods are 
double checked against the 
GDN prior to signing and 
sending out. 


Inspect the GDN for evidence of 
the signature to confirm the 
physical goods have been 
checked to the GDN and the 
GDN has been checked against 
the order prior to despatch. 


Customers sign the GDN and 
return it to Murray Co: this helps 
o minimise disputes as proof of 
delivery and acceptance of 
goods is obtained. 


Disputes with customers may 
result in overstatement of 
receivables and also a loss of 
customer goodwill. 


Inspect a sample of GDNs 
retained by the warehouse to 
ensure they are signed by 
customers to confirm receipt of 
goods and to confirm they are 
retained in the warehouse in 
case of disputes. 
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The invoice is raised from the 
GDN: this ensures the invoice 
relates to the actual quantity of 
goods despatched rather than the 
order which may be different. 


This reduces the risk of customers 


being invoiced incorrectly which 
would result in misstatement of 
revenue and receivables. This 
could also cause customer 
dissatisfaction and a loss of 
customer goodwill. 


Inspect the GDNs for evidence 
of being matched to invoices. 
Agree the details on both to 
ensure the control has been 
effective. 


Sales invoices are prepared using 
the company price list: this 
ensures customers are invoiced 
correctly. 


Incorrect invoicing will result in 
misstatement of revenue and 


receivables. This could also cause 


customer dissatisfaction and a 
loss of customer goodwill. 


Inspect the price list for approval 
by the directors. 


Obtain a copy of the current 
price list and, for a sample of 
invoices, agree that the correct 
prices have been used. 


Agree the prices in the system 
to the approved price list. 


Enquire of management who 
has authority to amend standing 
data such as prices in the 
system to ensure only persons 
of suitable authority have 
access. 


Try to input a change to the 
prices in the system using a 
user ID of a clerk to ensure that 
the system does not allow 
access to this standing data. 


Discounts must be requested by a 
sales manager and authorised by 
the sales director: segregation of 
duties and authorisation. 


This reduces the risk of fraud and 
unauthorised discounts which will 
result in loss of revenue for the 
company and possible 
misstatement within the 
accounting records. 


With the client's permission, 
attempt to process an invoice 
with a sales discount not 
authorised by the sales director. 
The system should reject the 
invoice. 


Inspect sales orders with 
discounts given for evidence of 
the sales director's signature 
authorising the discount. 
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Review of the list of individual 
customers for credit balances: 
identifies possible overpayments 
or errors within the trade 
receivables account. 


Errors in the accounting records 
can be promptly corrected. 


Inspect the list of individual 
customers for evidence of 
monthly review for credit 
balances such as a manager's 
signature. 


Monthly customer statements sent 
to customers: reminds customers 
of the invoices they need to pay 
and enables them to identify 
errors in invoices which can be 
notified to Murray Co. 


This can reduce the risk of 
irrecoverable debts. Irrecoverable 
debts will reduce profit and cash 
inflows and if not written off will 
result in overstatement of 
receivables. 


For a sample of customers, 
inspect copies of monthly 
statements sent out to confirm 
statements are in fact issued. 


Receipts are counted by the office 
assistant, recorded by the cashier, 
and the sales ledger clerk agrees 
the amount received to the 
amount invoiced: segregation of 
duties. 


Segregation of duties reduces the 
tisk of fraud which could cause 
misstatement in the accounting 
records and loss for the company. 


Observe the cash receipt 
process to assess the adequacy 
of segregation of duties. 


(b) 


Control deficiencies and recommendations 


Control deficiency 


Recommendation 


Credit checks are only 
reperformed if a customer 
requests an increase to their 
credit limit. 


A customer's credit rating may 
have deteriorated but Murray Co 
will not know and continue to give 
the same level of credit which 
increases the risk of irrecoverable 
debts, affecting profit and cash 
flow. Irrecoverable debts may 
result in possible overstatement of 
receivables. 


Credit checks should be 
performed annually to ensure 
the credit limit originally given to 
the customer is still appropriate. 
If the credit status has changed, 


the credit limit should be revised. 
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Credit limits are checked after the 
order has been accepted. 


The customer may not have 
sufficient credit which may result 
in irrecoverable debts and a 
reduction to profit. Irrecoverable 
debts may result in overstatement 
of receivables. 


Credit limits should be checked 
before the order is confirmed to 
ensure the customer has 
sufficient credit. 


Sales invoices are not 
sequentially numbered. 


Goods may not have been 
invoiced which will result in lost 
revenue and profit for the 
company. 

The company will not be able to 
identify if any invoices are missing 
resulting in understatement of 
revenue. 


Sales invoices should be 
sequentially numbered and a 
sequence check should be 
performed by the accounts 
department on a daily/weekly 
basis. Any breaks in the 
sequence should be 
investigated. 


No review is performed to ensure 
all goods have been invoiced. 


Goods may not have been 
invoiced which will result in 
understatement of revenue. 


A review should be performed to 
ensure that every GDN has a 
matching invoice to ensure all 
goods have been invoiced. 


The list of individual customer 
balances is only reconciled when 
the sales manager has time. 


Errors may exist within the 
receivables accounting records 
which will not be identified and 
resolved on a timely basis. 


The list of individual customer 
balances should be reconciled to 
the trade receivables account on 
a monthly basis. 


The reconciliations should be 
reviewed by a different, 
responsible official to ensure the 
reconciliation has been 
performed properly. 


The credit controller only follows 
up on balances which are six- 
months overdue. 


This increases the risk of 
irrecoverable debts which will 
reduce profit and cash inflows. 
Irrecoverable debts may result in 
overstatement of receivables. 


Credit control procedures should 
be followed to ensure full and 
prompt payment by customers, 
e.g. a telephone call to the 
customer followed by a letter. 
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Test your understanding 2 


Ordering 


Control 


Test of control 


Centralised purchasing 
department: ensures that 
purchasing is cost effective 
and only necessary goods and 
services are procured, 
reducing the risk of loss to the 
company and unnecessary 
cash outflow. 


Over-ordering of goods could 
lead to a build-up of inventory 
levels which could result in 
overstatement of inventory. 


Inspect the organisation chart to 
verify that a centralised purchasing 
department is in place. 


Enquire of the purchasing director 
whether all purchases must go 
through the department, or if some 
purchases are made within 
individual departments, to assess 
the effectiveness of the control. 


Inspect a sample of purchase 
orders to ensure they have been 
generated by the central purchasing 
department. 


Requisitions are authorised 
and manager's signature 
agreed: ensures only 
necessary goods and services 
are procured, reducing the risk 
unnecessary cash outflow. 


Unnecessary goods could lead 
to a build-up of inventory levels 
which could result in 
overstatement of inventory. 


Unauthorised purchases could 
be fraudulent which would 
result in expenses not 
pertaining to the company 
(occurrence assertion). 


Inspect a sample of requisitions for 
the signature of an appropriate 
manager. 


Inventory levels are checked 
prior to ordering: ensures only 
necessary goods and services 
are procured, reducing the risk 
of inventory becoming 
obsolete which could lead to 
overstatement of inventory and 
loss for the company. 


Inspect a sample of requisitions for 
evidence of inventory levels being 
checked first, such as a signature. 


Observe the ordering process to 
see the ordering clerk checking 
inventory levels first. 
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Sequentially pre-numbered 
purchase orders and a weekly 
check by warehouse manager: 
ensures that all goods and 
services ordered are received so 
any missing purchase orders can 
be followed up. This reduces the 
risk of production delays which 
will result in dissatisfied 
customers and a loss of customer 
goodwill. 


Missing purchase orders will 
result in an incomplete audit trail 
and may affect the auditor's 
ability to obtain sufficient and 
appropriate evidence over 
purchases. 


Review the purchase orders for 
evidence of the warehouse 
manager's weekly sequence 
check such as a signature to 
confirm it has been performed. 


Approved supplier list: gives 
assurance about the quality of 
goods and services and reliability 
of the suppliers. Poor-quality 
supplies will affect the quality of 
he product sold resulting in 
complaints from customers and 
damage to the company's 
reputation reducing future sales. 


If product quality is affected, 

here is a risk of overstatement of 
inventory and understatement of 
refund liabilities. 


For a sample of purchase orders 
placed, agree the supplier name 
to the approved supplier list. 


Attempt to place an order with an 
unapproved supplier. The system 
should not allow it to proceed. 


Prices are agreed to the price list 
and discounts checked: ensures 
hat the correct prices are being 
charged by the supplier and 
discounts are being obtained. 
This ensures accuracy of 
purchases and payables and 
reduces the risk of loss to the 
company and unnecessary cash 
outflow. 


Inspect a sample of purchase 
orders for evidence of prices 
having been agreed to the price 
list such as a signature of the 
person checking. 


Select a sample of orders and 
agree to the authorised price list 
to test the effectiveness of the 
control. 
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Goods receipt 


Control 


Test of control 


Goods received into the central 
warehouse. Having one, secure 
delivery area prevents goods 
received being lost or stolen 
reducing the risk of loss to the 
company and misstatement of the 
inventory balance. 


Visit a warehouse and inspect the 
delivery area for security of goods 
e.g. locked area, security guard, 
CCTV. 


Goods are inspected for condition 
and quantity and agreed to the 
purchase order. This prevents 
Murray Co from paying for 
unnecessary, or poor-quality 
goods which would result in loss 
for the company and unnecessary 
cash outflow. 


Damaged goods received and not 
returned to the supplier may result 
in overstatement of inventory. 


Observe the goods receipt process 
to ensure goods are inspected for 
condition and quantity before the 
supplier's delivery note is signed. 


Inspect the delivery note for a 
signature confirming the goods 
have been checked on arrival. 


Sequentially pre-numbered goods 
received note (GRN) prepared by 
the warehouse team manager and 
a sequence check performed by 
the purchase ledger manager. 
This ensures that all goods 
received are recorded which will 
ensure completeness of inventory 
balances. 


Inspect evidence of the sequence 
check being performed such as a 
signature of the warehouse 
manager. 


Grid stamp: a grid stamp is a grid 
that can be ink-stamped onto any 
document, with boxes for 
recording different information 
such as confirmation the goods 
have been inspected for condition 
and agreed to the purchase order. 
This prevents Murray Co from 
paying for unnecessary or poor- 
quality goods reducing the risk of 
loss to the company and 
unnecessary cash outflow. 


This reduces the risk of 
inappropriate valuation of 
inventory. 


Inspect a sample of GRNs to 
ensure they are grid-stamped and 
signed by the warehouse operative 
to confirm the goods have been 
inspected and agreed to the PO. 
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Inventory system updated ona 
daily basis by the warehouse 
manager: prevents unnecessary 
goods being ordered and ensures 
accuracy of inventory balances. 
This reduces the risk of not being 
able to fulfil customer orders 
which could result in dissatisfied 
customers and a loss of customer 
goodwill. 


Inspect a sample of GRNs for the 
previous day to ensure the 
inventory system has been 
updated for them. 


Invoicing 


Control 


Test of control 


The invoice is matched to the 
GRN: by matching the invoice to 
the GRN and not the original order 
it ensures that only goods that 
have been received are paid for, 
reducing the risk of loss to the 
company and unnecessary cash 
outflow and ensuring accuracy of 
purchases and payables. 


Inspect a sample of invoices and 
ensure they are filed with the 
relevant GRN, and the invoice 
number is written on the GRN. 


Using the purchase order number 
marked on the invoice: when 
placing an order, the supplier will 
be given the purchase order 
number. This allows the purchase 
to be matched to the relevant 
GRN and requisition and the 
company can efficiently trace the 
relevant documentation in case of 
queries. 


Inspect a sample of invoices for 
the PO number and that it is 
matched to the relating GRN and 
requisition. 


The invoice number is noted on 
the GRN grid stamp, and a 
monthly check of GRNs with no 
invoice: this prevents goods 
received being invoiced twice 
which would cause loss to the 
company and overstatement of 
purchases and payables. 


Review the GRN for the grid 
stamp. 


Inspect evidence of signature to 
confirm the monthly check has 
been carried out by the purchase 
ledger manager. 
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Control 


Test of control 


Batch controls: the system will 
notify the clerk inputting the data 
of how many invoices have been 
input. This will be checked to the 
physical number of invoices and 
will highlight if too many or too few 
invoices have been entered. This 
ensures accuracy of the 
purchases and payables figures in 
the accounting records enabling 
invoices to be paid on time 
reducing the risk of disputes with 
suppliers. 


Inspect a sample of batch control 
sheets for evidence of completion 
and agreement to the batch 
system report. 


Invoice stamped as ‘recorded’ and 
checks to ensure all invoices 
recorded: Prevents under or 
overstatement of trade payables 
reducing the risk of disputes with 
or late payments to suppliers. 


Select a sample of invoices 
recorded on the system and 
inspect them to ensure they are 
marked as ‘recorded’. 


Supplier statement reconciliations: 
enables errors in the recording of 
purchases, payments and 
liabilities to be identified and 
corrected. This reduces the risk of 
disputes with suppliers and 
ensures accuracy of the 
accounting system relating to 
purchases and payables. 


For a sample of suppliers, inspect 
the monthly supplier statements 
received for evidence of the 
reconciliation being performed. 
Reperform the reconciliation to 
confirm it has been reconciled 
correctly to test the effectiveness 
of the control. 


Trade payables account 
reconciliation: ensures that credits 
and payments recorded in 
individual supplier accounts have 
also been recorded in the 
accounts (and vice versa). 


Segregation of duties monitors 
performance of controls and 
ensures accuracy of the 
accounting system in relation to 
purchases and payables. 


Inspect the account reconciliations 
for evidence of performance and 
review on a monthly basis. 
Reperform the reconciliation to 
ensure it has been carried out 
effectively. 
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Control 


Test of control 


The company accountant checks 
and authorises payments: 
payments should only be 
authorised by a senior member of 
he finance department to prevent 
error or fraud which could result in 
loss for the company and 
misstatements in the accounting 
records. 


For a sample of payments made, 
inspect the payment list for 
evidence of the company 
accountant's review and 
authorisation. 


Individual payments of more than 
25,000 or total payments of more 
han $250,000 require a second 
signatory: a second signatory 
prevents fraud on unusual 
ransactions which could result in 
loss for the company and 
misstatements in the accounting 
records. The additional check by 
he financial controller or finance 
director further enhances this 
control. 


Inspect a sample of invoices 

> $25,000 for evidence of a second 
signatory and agree that the 
signature is of someone with 
authority to authorise such 
amounts. 


Inspect the invoices for the 
additional signature of the financial 
controller or finance director. 


Payments are made by the 
cashier's office and recorded by 
he purchase ledger team: 
segregation of duties prevents 
raud which could result in loss for 
he company and misstatements 
in the accounting records. 


Observe the process of payments 
from the cashier's office to ensure 
segregation of duties is in place. 


Invoices are stamped as ‘paid’ 
and filed separately from invoices 
not yet paid: this prevents invoices 
being paid twice which could 
result in loss for the company and 
unnecessary cash outflow and 
would result in misstatement of 
payables and purchases. 


Inspect the file of paid invoices and 
ensure they are kept separate from 
invoices not yet paid. Inspect them 
stamped as ‘Paid’. 
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Test your understanding 3 


7 


Control de 


ney 


Recommendation 


Standing data is updated by the 
payroll clerk. 


The payroll clerk is not sufficiently 
senior to be making changes to 
standing data. Mistakes or 
unauthorised changes could be 
made, causing loss for the 
company or employee 
dissatisfaction. 


Amendments to standing data 
should be performed by a senior 
member of the payroll department 
and this should be checked by 
another responsible official. 


Exception reporting functionality 
is currently not utilised by Murray 
Co. 


Unauthorised changes or 
incorrect amendments to payroll 
will not be identified on a timely 
basis, which could cause loss for 
the company. 


An exception report should be 
produced on a regular basis e.g. 
monthly. The report should be 
reviewed by a responsible official 
such as the payroll director. Any 
unexpected amendments should 
be investigated. 


Clock cards submitted and input 


The clocking in process is not 
supervised. 


This could result in a number of 
employees being clocked in as 
present when they are not. 


This will result in increased 
payroll cost for Murray Co. 


The clocking in and out process 
should be monitored by installing 
CCTV over the clocking in/out 
area or introducing a video 
access system to identify 
individuals as they enter the 
building. 


Alternatively, a responsible official 
should oversee the process to 
prevent one individual clocking in 
multiple employees. 


The hours worked entered into 
the payroll system by the payroll 
clerk is not checked. 


Mistakes or unauthorised 
changes could be made, causing 
loss for the company or employee 
dissatisfaction. 


Hours worked entered into the 
system by the payroll clerk should 
be checked by the payroll 
manager before the payroll 
system calculates the gross and 
net pay, and deductions. 
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Payroll calculations 


The payroll system automatically 
calculates the gross pay, net pay 
and deductions but there are no 
checks performed. 


Errors occurring within the system 
would not be identified. 


This could result in payroll being 
over or under calculated, leading to 
an additional payroll cost or loss of 
employee goodwill. 


A senior member of the payroll 
team should recalculate the 
gross to net pay workings for a 
sample of employees and 
compare their results to the 
output from the payroll system. 
These calculations should be 
signed as checked and 
confirmed before payments are 
made. 


Payments to employees 


© Tutorial note 


The payment of wages in cash is not a deficiency in itself. 


The payroll manager reviews the 
bank transfer listing prior to 
authorising the payments and if 
any discrepancies are noted, 
always makes the adjustment in 
the payroll records for any changes 
required. 


There is a lack of segregation of 
duties. The manager could 
fraudulently increase or incorrectly 
amend the amounts to be paid to 
certain employees, process this 
payment as well as amend the 
records. This will cause loss for the 
company. 


The payroll manager should not 
be able to process changes to 
the payroll system as well as 
authorise payments. 
Discrepancies should be 
thoroughly investigated, and 
adjustments made in the 
relevant record as required. 


The authorisation of the bank 
transfer listing should be 
undertaken by an individual 
outside the payroll department, 
such as the finance director. 


Prepared pay packets are sent to 
the employee’s supervisor, who 
distributes them to employee at the 
end of their shift. 


The supervisor is not sufficiently 
independent to pay wages out. 
They could adjust pay packets to 
increase those of close friends 
whilst reducing others. 


This will cause loss for the 
company. 


Employees paid in cash should 
collect their pay packets from 
the payroll department or 
cashier's office. 
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In addition, employees do not have | Employees paid in cash must 
to sign anything to say they have sign a collection receipt to 
received their wages. This could confirm they have received their 
result in employees claiming that wages and that they have been 
they have not been paid when they | paid the correct amount. 

have and payments being made 
twice which will increase cost for 
the company. 


Payroll costs and payments recorded 


A payroll account reconciliation is The payroll account 

performed by the financial reconciliations should be 
controller but is not reviewed. reviewed by the finance director 
once prepared, even if there are 
no exceptions. There should 
evidence of the review by way of 
a signature on the reconciliation. 


The reconciliation could reconcile 
but contain significant 

compensating errors which cancel 
each other out. 


If it is not reviewed, then this 
reduces its effectiveness and 
fraudulent payroll expenses will not 
be identified. This will cause loss 
for the company. 


(TI Test your understanding 4 


Deficiency and effect Recommendation 


Recording of orders 


Orders placed on the website are | The computer system should be 


transferred manually into the upgraded so that order details 
inventory and sales system. are transferred directly between 
Manual transfer may result in the two computer systems. This 
errors in the accounting system. will remove manual transfer of 


details, limiting the possibility of 


Customers will be sent incorrect 
human error. 


goods resulting in increased 
customer complaints and a loss of 
customer goodwill. 


KAPLAN PUBLISHING 307 


Systems and controls 


308 


Control over orders and 
packing lists 


Each order/packing list is given a 
random alphabetical code. This 
type of code makes it difficult to 
check completeness of orders. 


Packing lists can be lost resulting 
in goods not being despatched to 
the customer which will result in a 
loss of customer goodwill. The 
order may be sent but the 
customer's credit card may not be 
charged which would result in 
understatement of revenue. 


Orders/packing lists should be 
controlled with a numeric 
sequence. 


At the end of each day, a 
sequence check should be 
performed and any gaps in the 
sequence should be investigated. 


Obtaining payment 


The customer's credit card is 
charged after despatch of goods 
to the customer, meaning that 
goods are already sent to the 
customer before payment is 
authorised. 


Rhapsody Co will not be paid for 
the goods despatched where the 
credit company rejects the 
payment request. Given that 
customers are unlikely to return 
seeds, Rhapsody Co will 
automatically incur an irrecoverable 
debt which reduces profit and cash 
inflow and leads to a potential 
overstatement of receivables. 


Authorisation to charge the 
customer's credit card should be 
obtained prior to despatch of 
goods and the card should be 
charged on despatch to ensure 
Rhapsody Co is paid for all 
goods sent to customers. 


Completeness of orders 


There is no overall check that all 
orders recorded on the inventory 
and sales system have actually 
been invoiced and the customer's 
credit card charged. 


Orders despatched may not have 
been invoiced resulting in 
understatement of revenue and 
profit. If the credit card has not 
been charged the company will 
experience a reduction in cash 
flow. 


An exception report of orders not 
invoiced should be generated 
each week. Orders where there 
is no corresponding invoice 
should be investigated. 
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Test your understanding 5 


The auditor can increase the amount 


of controls testing in that audit 


area. This may indicate that the control deficiency was not as bad as 


initially thought. 


The problem can be raised with management and those charged with 
governance so that corrective action can be taken. 


The auditor can perform additional substantive procedures on the audit 
area. If controls have not worked effectively there is a greater risk of 
misstatement. Substantive procedures will be used to quantify the 


misstatement. 


If the matter is not resolved, then the auditor will also need to consider 
the implications for the auditor's report. 


Test your understanding 6 


Tests of control 


(a) 


A test of control tests the operating effectiveness of controls in 


reduce detection risk, and there’ 
evel. 


(b) 


preventing, detecting or correcting material misstatements. 


It is important for the external auditor to test controls to ensure 
heir initial understanding obtained when assessing the control 
environment and internal controls is appropriate. 


This will allow the auditor to identify and assess the risks of 
material misstatements in the financial statements and determine 
he amount of reliance that can be placed on the controls. 


The auditor is then able to design substantive audit procedures to 


ore audit risk, to an acceptable 


Direct controls and tests of control 


Direct control (i) 


Test of control (ii) 


All staff are assigned a unique ID 
card by the personnel department 
to record hours worked. 


Segregation of duties between 
allocating the cards and 
processing payroll will reduce the 
risk of fraud such as the creation 
of ‘ghost’ employees by the payroll 
department. 


Ask a sample of employees to 
confirm who provided them with 
their unique ID card on joining 
the business. 


Inspect the ID cards for 
existence. Agree the employee 
details to HR records. 
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Hours worked are authorised by 
divisional heads. 


There is a reduced risk that hours are 
overstated as the divisional head is 
more likely to identify errors or 
anomalies. This reduces the risk of 
incorrect payments being made 
which will cause misstatement of 
payroll costs. 


Inspect the emails sent each 
month by the head of division 
authorising the hours worked. 


The payroll system is password 
protected with an alphanumerical 
password known only to the payroll 
clerk and finance manager. 

The password is difficult to guess and 
therefore will limit the risk of 
unauthorised access which could 
lead to payroll data being 
manipulated and payroll costs being 
misstated. This reduces the risk of 
fraud and loss to the company. 


The auditor should use test 
data and enter a ‘dummy’ 
password into the payroll 
system to ensure that access 
is not granted. 


Payroll calculations are automatically 
calculated by the standardised payroll 
software. Calculation by the system is 
less vulnerable to error. This ensures 
accuracy of payroll costs and 
minimises the risk of incorrect 
payments being made which could 
result in dissatisfied employees. 


The auditor should recalculate 
a sample of employee's 
monthly pay from across the 
year and compare to the 
calculations on the payroll 
report for those months. 


The finance manager reviews the 
payroll report and compares to last 
month before the final payroll is 
processed. 

The comparison of data to the prior 
month should highlight any errors 
before the payroll is processed. This 
reduces the risk of incorrect payments 
being made to employees which could 
result in misstatement of payroll and 
dissatisfied employees. 


For a sample of months, 
inspect the payroll reports for 
evidence of the finance 
manager's signature 
confirming that the review has 
been performed. 


Payslips are sent to the home 
address of each employee. 

This should reduce the risk that 
payslips are misplaced or 
manipulated. It would also reduce the 
risk of a confidentiality breach. 


Ask a sample of employees to 
confirm they receive their 
monthly payslips via post to 
their home address. 

Observe the process of 
sending payslips to 
employees. 
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1 Cc Segregation of duties helps to prevent fraud. 
2 D Enquiry is not the most reliable form of evidence as the 


clerk or the manager could say what they think the 
auditor wants to hear. Recalculation of payroll by the 
auditor is a substantive test and does not confirm the 
manager has performed the necessary checks. 


3 A Inspection of employee contracts to confirm salary 
details is a substantive procedure. 


4 B The department manager would identify if any fictitious 
employees or employees who had left the company 
were included on the list and could notify the payroll 
department before any invalid payments were made. 


5 A Internal audit can monitor the effectiveness of controls 
by regularly testing them. B, C and D are all examples 
of control activities that would be tested for 
effectiveness. 
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4 


Cc 


The auditor must ensure the systems documentation held 
on file is still correct. This can be achieved through a 
combination of enquiry and walkthrough tests but enquiry 
alone is not sufficient appropriate evidence. 


Tests of controls must be performed when the auditor is 
planning to place reliance on controls over areas of 
significant risk. If the auditor has decided that substantive 
testing is more efficient for a specific balance, it is not 
necessary to test the controls over that area. Reliance 
can be placed on the results of tests of controls 
performed in previous years to some extent, however, the 
auditor must perform tests of controls over some areas. 
For areas where controls are not tested this year, the 
auditor must ensure they are tested within a three-year 
cycle. 


An internal control evaluation questionnaire asks the 
client to respond with the control in place that addresses 
a risk. Restricted access as given in answer D is a 
control. This question would be included in an internal 
control questionnaire rather than an internal control 
evaluation questionnaire. 


The external auditor should not monitor the controls, as 
this requires ongoing involvement in the company on a 
regular basis. Whilst the external auditor may test the 
controls and identify deficiencies, this does not constitute 
monitoring. Management is ultimately responsible for the 
internal controls including assessing whether they are 
effective and whether any improvements are required. 
They may utilise an external consultant or internal audit 
function to help them fulfil this responsibility. 


Flowchart — a diagram depicting controls in place at each 
stage 


ICQ/ICE — a disadvantage of this method may be that 
controls are overstated 


ICQ/ICE — An advantage of this method is that they are 
easy to prepare in advance and therefore efficient 


Narrative notes — For larger systems this method may 
be time consuming and it may be difficult to identify 
missing controls 
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Chapter learning objectives 


This chapter covers syllabus areas: 


. C5 — Internal audit and governance, and the differences 
between external audit and internal audit 


. C6 — The scope of the internal audit function, outsourcing 
and internal audit assignments 


Detailed syllabus objectives are provided in the introduction 
section of the text book. 


One of the PER performance objectives 
(PO19) is to collect and evaluate evidence for 
an audit. Carry out an internal or external audit 
from collecting evidence, through to forming an 


opinion. You demonstrate professional 
scepticism and make sure judgements are 
based on sufficient valid evidence. Working 
through this chapter should help you 
understand how to demonstrate that objective. 
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Need for 
internal audit 


Role of 
internal audit 
INTERNAL AUDIT 


Difference between 
internal and 
external audit 


Outsourcing 


1 The need for internal audit 


Internal audit is an independent, objective assurance and consulting 
activity designed to add value and improve an organisation’s operations. 


A company must create a strong system of internal control in order to fulfil its 
responsibilities. 


However, it is not sufficient to simply have mechanisms in place to manage a 
business, the effectiveness of those mechanisms must be regularly evaluated. 
All systems need some form of monitoring and feedback. This is the role of 
internal audit. 


Having an internal audit department is generally considered to be best practice, 
but is not required by law. This allows flexibility in the way internal audit is 
established to suit the needs of a business. 


In small, or owner managed businesses there is unlikely to be a need for 
internal audit because the owners are able to exercise more direct control over 
operations, and are accountable to fewer stakeholders. 


The need for internal audit (IA) therefore will depend on: 


. Scale and diversity of activities. In a larger, diversified organisation there is 
a risk that controls don't work as effectively because of the delegation of 
responsibility down the organisation. Internal audit can report back to the 
audit committee if controls are not as effective as they should be. 


. Complexity of operations. The more complex the organisation is, the 
greater the benefit obtained from having an IA function as there is greater 
risk of things going wrong. With larger organisations the consequences of 
poor controls/risk management/corporate governance practices are likely 
to be greater. 
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. Number of employees. The greater the number of employees the greater 
the risk of fraud. 


. Cost/benefit considerations. It will be worthwhile establishing an IA 


function if the benefits outweigh the costs. For example, a company might 


be losing money as a result of fraud, not using the most cost effective or 
reliable suppliers, or incurring fines for non-compliance with laws and 


regulations. If these costs outweigh the cost of employing an IA function it 


will be beneficial to the company to establish a department. 


. The desire of senior management to have assurance and advice on risk 
and control. The directors may wish to have the comfort that there is 
ongoing monitoring of the organisation to help them discharge their 
responsibilities. 


. The current control environment and whether there is a history of fraud or 


control deficiencies. If so it will be beneficia! 
an internal audit function to prevent and de 


for the company to establish 
ect fraud. 


2 The difference between internal and external auditors 


External audit 


Internal audit 


Objective Express an opinion on the Improve the company's 
truth and fairness of the operations by reviewing the 
financial statements in a efficiency and effectiveness 
written report. of internal controls. 

Reporting Reports to shareholders. Reports to management or 

those charged with 
governance. 

Availability of | Publicly available. Not publicly available. 

report Usually only seen by 


management or those 
charged with governance. 


Scope of work 


Verifying the truth and 
fairness of the financial 
statements. 


Wide in scope and 
dependent on management's 
requirements. 


with company 


company. 


Appointment By the shareholders of the By the audit committee or 
and removal company. board of directors. 
Relationship Must be independent of the May be employees (which 


limits independence) or an 
outsourced function (which 
enhances independence). 
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The role of the internal audit function 


The role of internal audit can vary depending on the requirements of the 
business. 


Key activities of the internal audit function 


Assessing whether the company is demonstrating best practice in 
corporate governance. 


Evaluating the company's risk identification and management processes. 
Testing the effectiveness of internal controls. 
Assessing the reliability of financial and operating information. 


Assessing the economy, efficiency and effectiveness of operating activities 
(value for money). 


Assessing compliance with laws and regulations. 


Providing recommendations on the prevention and detection of fraud. 


Most of these activities can be seen as helping management comply with 
corporate governance requirements. 


Additional roles 


In addition to the above, internal audit will carry out ad hoc assignments, as 
required by management. For example: 


Fraud investigations — this may involve detecting fraud, identifying the 
perpetrator of a fraud and quantifying the loss to the company as a result 
of a fraud. 


IT systems reviews — performing a review of the computer environment 
and controls. 


Mystery shopper visits — for retail and service companies the internal audit 
staff can pose as customers to ensure that customer service is at the 
required level. 


Contract audits — making sure that where significant or long term contracts 
are entered into by the organisation, the contract is written to protect the 
organisation appropriately and contractual terms are being adhered to by 
the supplier in line with the service level agreement. 


Asset verification — such as performing cash counts and physical 
inspection of non-current assets to verify existence. 


Providing direct assistance to the external auditor — internal audit staff can 
help the external auditor with their procedures under supervision, in 
accordance with ISA 610. This is covered in the 'Evidence' chapter. 
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Qualities of an effective internal audit function 


. Sufficiently resourced, both financially and in terms of qualified, 
experienced staff. 


. Well organised, so that it has well developed work practices. 


Independent and objective to provide an unbiased view of the 
organisation’s operations. 


The chief internal auditor should be appointed by the audit committee to 
reduce management bias. 


The department should have no operational responsibilities to reduce the 
threat of self-review. 


The audit committee should set the plan of work. 


. There should be no limitation on the scope of their work i.e. full access to 
every part of the organisation. 


tations of internal audit 


Internal auditors may be employees of the company they are reporting on 
and therefore may not wish to raise issues in case they lose their job. 


In smaller organisations in particular, internal audit may be managed as 
part of the finance function. They will therefore have to report on the 
effectiveness of financial systems of which they form a part and may be 
reluctant to say their department (and manager) has deficiencies. 


. If the internal audit staff have worked in the organisation for a long time, 
possibly in different departments, there may be a familiarity threat as they 
will be auditing the work of long standing colleagues and friends. 


It is therefore difficult for internal audit to remain truly objective. However, 
acceptable levels of independence can be achieved through one, or more, of 
the following strategies: 


. Reporting channels separate from the management of the main financial 
reporting function. 


. Reviews of internal audit work by managers independent of the function 
under scrutiny. 


. Outsourcing the internal audit function to a professional third party. 


4 Outsourcing the internal audit function 


In common with other areas of a company’s operations, the directors may 
consider that outsourcing the internal audit function represents better value than 
an in-house department. 


Outsourcing is where the company uses an external company to perform its 
internal audit service instead of employing its own staff. 
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Advantages 


Professional firms follow an ethical code of conduct and should therefore 
be independent of the client. 


Professional firms should have qualified, competent staff who receive 
regular development and have a broader range of expertise. 


An outsourcing firm will have specialist skills readily available therefore 
outsourcing can be used to overcome a skills shortage. 


Professional firms can be employed on a flexible basis, i.e. on an 
individual engagement basis rather than full time employment which may 
prove more cost effective. 


Employment costs of permanent staff are avoided. 
The risk of staff turnover is passed to the outsourcing firm. 
Professional firms are responsible for their activities and hold insurance. 


There is likely to be greater focus on cost and efficiency of the internal 
audit work as this will affect profitability of the assignment. 


The company will obtain access to new market place technologies without 
the associated costs, e.g. data analytic tools and audit software. 


Management time in administering an in-house department will be 
reduced. 


Disadvantages 


Professional firms lack the intimate knowledge and understanding of the 
organisation that employees have. 


The decision may be based on cost with the effectiveness of the function 
being reduced. 


Engagements with professional firms are constrained by contractual 
erms. Flexibility and availability may not be as high as with an in-house 
unction. 


Fees charged by professional firms may be high. 


An ethical threat may arise if the service is provided by the external audit 
firm. E.g. the ACCA Code of Ethics and Conduct prohibits external 
auditors of a listed company from providing internal audit services for the 
same client where the service relates to financial reporting systems. 


Pressure on the independence of the outsourced function, for example, if 
management threaten not to renew the contract. 


Lack of control over the quality of service. 
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5 Internal audit assignments 


Internal auditors perform many different types of assignment. Common 
examples include: 


. Value for money assignments 
. Operational audits 
. The audit of IT systems 


. Financial audit. 


Value for money 


Value for money (VFM) is concerned with obtaining the best possible 
combination of services for the least resources. It is often referred to as a 
review of the three Es: 


. Economy - obtaining the best quality of resources for the minimum cost. 


. Efficiency — obtaining the maximum departmental/organisational outputs 
with the minimum use of resources. 


. Effectiveness — achievement of goals and targets 
(departmental/organisational etc.). 


Comparisons of value for money achieved by different organisations 

(or branches of the same organisation) are often made using performance 
indicators that provide a measure of economy, efficiency or effectiveness. 
This is particularly common in the not-for-profit sector (i.e. public services 

and charities), but it can apply to any company. 


For example, a company chooses the cheapest supplier for the materials it 
needs. The supplier has a lead time for delivery of 6 weeks. If the company 
needs a supplier that can deliver at short notice on a regular basis this will not 
be effective. 


If a company sources lower quality materials at a price 10% cheaper than its 
current supplier but uses 50% more as a result of the lower quality, this is not 
efficient. 


ea 


Examples of value for money indicators for a hospital might include: 
. Economy — cost of medical supplies per annum. 


. Efficiency — number of patients treated per year, utilisation rate of 
beds/operating theatre. 


. Effectiveness — recovery rates, number of deaths. 
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An operational audit is a systematic review of the efficiency and effectiveness of 
operations within the organisation. The focus of the audit is on the processes 
which take place within the organisation to identify if they can be streamlined 
and performed more efficiently. The more efficient a process is, the more 
profitable the organisation should be. 


For example, during an operational audit the internal auditor may find that 
orders are manually entered into a sales system to record an order. A copy of 
the order is passed to the despatch department who manually enter the details 
into the despatch system. A copy of the goods despatch note is sent to the 
finance department for invoicing and the details are manually entered into the 
invoice. 


In addition to the risk of error that arises each time the details are manually 
entered, this is a time consuming and inefficient process. 


The internal auditor may recommend that an integrated system is introduced to 
remove the need for the data to be entered by each department. If the order 
system links to the despatch system and the despatch system links to the 
finance system, no manual entry will be required after the order has been 
entered in the first instance. 


The audit of IT systems 


The external auditor considers IT systems from the perspective of whether they 
provide a reliable basis for the preparation of financial statements, and whether 
there are internal controls which are effective in reducing the risk of 
misstatement. 


Internal audit will also consider this, however, its role is much wider in scope 
and will also consider whether: 


. the company is getting value for money from its IT system. 
. the procurement process for the IT system was effective. 
. the ongoing management/maintenance of the system is appropriate. 


Whilst this is an ongoing role, project auditing can be used to look at whether 
the objectives of a specific project, such as implementing new IT systems, were 
achieved. 


The main aim of a financial reporting system is to create accurate, complete 
and timely information which can be used for decision making and business 
planning. This information is also needed to satisfy the requirements of actual 
and potential investors and trading partners. 
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Typical examples of financial information include: 
. Financial statements 

. Monthly management accounts 

. Forecasts and projections. 


The main aim of internal financial audits is to ensure that the information 
produced is reliable and produced in an efficient and timely manner. If not, 
executive decisions may be based on unreliable information. 


The other aim of a financial audit is to assess the financial health of a business. 
More importantly it is about ensuring there are mechanisms in place for the 
early identification of financial risk, such as: 


. Adverse currency fluctuations 
. Adverse interest rate fluctuations 
. Cost price inflation. 


In both cases the focus of internal audit will be on the processes and controls that 
underpin the creation of the various financial reports to ensure they are as 
effective as possible for assisting decision making and the risk management 
processes of the company. 


6 Reporting 


Unlike an independent external auditor's report, the internal audit report does 
not have a formal reporting structure. It is likely that the format is agreed with 
the audit committee or board of directors prior to commencing the assignment. 


These reports will generally be for internal use only. The external auditors may 
inspect them if they are intending to place reliance on the work of internal audit. 


A typical report will include: 
. Terms of reference — the requirements of the assignment. 


. Executive summary — the key risks and recommendations that are 
described more fully in the body of the report. 


. Body of the report — a detailed description of the work performed and the 
results of that work. 


. Appendix — containing any additional information that doesn't belong in the 
body of the report but which is relevant to the assignment. 


S In the exam you may be asked to take the role of an internal auditor 
performing an audit assignment to test controls or identify improvements in 
efficiency that can be made. 


The internal audit report can be set out in the same way as the report to 
management that has been seen in the 'Systems and controls’ chapter, 
describing the deficiencies identified, consequences of those deficiencies 
and recommendations for improvement. 
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Test your understanding 1 


The internal audit function at Murray Co consists of a head of internal 
audit, two senior internal audit managers, four internal audit managers, 
seven internal auditors and an internal audit assistant. The head of 
internal audit has been in post for twelve years, and the other members 
of the team have varying lengths of service from two to fifteen years. 


The head of internal audit is responsible for recruiting staff into the 
internal audit team. The head of internal audit was appointed by the 
audit committee. 


The head of internal audit reports to the audit committee and agrees the 
scope of work for the internal audit function with the audit committee. 


The internal audit staff have no operational responsibility. Where the 
staff have previously transferred from another department within Murray 
Co, the head of internal audit ensures that another member of the team 
carries out the audit of that system. 


Murray Co's internal audit function follows the International Standards 
for the Professional Practice of Internal Auditing issued by the Global 
Institute of Internal Auditors. 


Barker Co's internal audit function 


The internal audit function at Barker Co consists of a chief internal 
auditor, one senior internal audit manager, one audit manager, one 
auditor and an audit assistant. The chief internal auditor has been in 
post for ten years, and the other members of the team have varying 
lengths of service from five to nine years. 


The finance director is responsible for recruiting all staff into the internal 
audit function. The chief internal auditor reports to the finance director 
and they agree the scope of the work for the internal audit function 
together. 


The internal audit team spend 50% of their time carrying out internal 
audit assignments and 50% of their time working in the finance 
department. Due to the limited number of staff in the team, this has 
resulted in the internal auditors reviewing their own work. 


Barker Co's internal audit team follow a variety of standards, in 
accordance with their own professional training. 


Required: 


Compare and contrast the effectiveness of Murray Co and Barker 
Co's internal audit functions. 


(6 marks) 
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Test your understanding 2 


You are the senior manager in the internal audit department of 

Octball Co, a limited liability company. You report to the chief internal 
auditor and have a staff of six junior auditors to supervise, although the 
budget allows for up to ten junior staff. 


In a recent meeting with the chief internal auditor, the difficulty of staff 
recruitment and retention was discussed. Over the past year, five junior 
internal audit staff have left the company, but only two have been 
recruited. Recruitment problems identified include the location of 
Octball Co's head office in a small town over 150 kilometres from the 
nearest major city and extensive foreign travel, often to cold climates. 


Together with the chief internal auditor you believe that outsourcing the 
internal audit department may be a way of alleviating the staffing 
problems. You would monitor the new outsourced department in a part- 
time role taking on additional responsibilities in other departments, and 
the chief internal auditor would accept the post of finance director (FD) 
on the board, replacing the retiring FD. 


Two firms have been identified as being able to provide the internal 
audit service: 


. The NFA Partnership (NFA), a large local firm specialising in the 
provision of accountancy and internal audit services. NFA does not 
audit financial statements or report to members. 


. T&M, Octball Co's external auditors, who have offices in 
75 countries and employ in excess of 65,000 staff. 
Required: 


(a) Discuss the advantages and disadvantages of appointing NFA 
as internal auditors for Octball Co. 


(8 marks) 


(b) Discuss the matters T&M need to consider before they could 
accept appointment as internal auditors for Octball Co. 


(7 marks) 


(c) Assume that an outsourcing company has been chosen to 
provide internal audit services. Describe the control activities 
that Octball Co should apply to ensure that the internal audit 
service is being maintained to a high standard. 


(5 marks) 
(Total: 20 marks) 
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Test your understanding 3 


You are an audit senior working at Monkey, Mia & Co. You have been 
seconded to your firm's internal audit department to broaden your 
experience. You have been assigned to an internal audit assignment to 
test the effectiveness of the computer systems at a large company. Your 
firm won the contract to provide internal audit services to the company 
after the company took the decision to outsource its internal audit 
function and make the existing internal audit staff redundant. 


1 With which of the following should the internal auditor not be 
involved? 


A Identifying deficiencies in internal controls 


B Providing recommendations to management on how to 
overcome the deficiencies identified 


C Implementing the new controls recommended 

D Evaluating the effectiveness of the new controls implemented 
2 Which TWO of the following statements are TRUE? 

(i) Internal auditors always report directly to shareholders. 


(ii) The format of the independent external auditor's report is 
determined by management. 


(iii) The internal auditor's work may be determined by 
management. 


(iv) All external audits must be planned and performed in 
accordance with International Auditing Standards and other 
regulatory requirements. 


A (i)and (iv) 
B (i) and (iii) 
C (ii) and (iii) 
D (iii) and (iv) 
3 Which of the following is NOT part of the role of internal 
audit? 


A Risk identification and monitoring 


B Expression of opinion to the shareholders on whether the 
annual financial statements give a true and fair view 


C Fraud investigations 


D Assessing compliance with laws and regulations 
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4 Which of the following is NOT a valid reason to outsource the 
internal audit function? 


A The external audit will be more efficient as the external audit 
staff will have a good understanding of the company if they 
are also involved with the internal audit work 


B Outsourcing may be more cost effective as compared with 
employing staff and providing training and other employment 
benefits 


C A professional firm is likely to be more experienced and able 
to provide better recommendations for improvements 


D Greater independence of an external service provider 
5 Identify whether the following statements are true or false. 


Internal audit reports must be produced ina True | False 
standardised format as set out by the financial 
reporting framework 


Internal audit reports are issued to shareholders True | False 


There is no legal requirement for companies to have | True | False 
an internal audit department 


The presence of an internal audit function may act as | True | False 
a deterrent for fraud 


KAPLAN PUBLISHING 325 


Internal audit 


7 Chapter summary 


Internal audit 


Controls 
Fraud 
Risk assessment 


Laws and regulations 
Mystery shopping 
(customer experience) 
VFM 

T 


326 KAPLAN PUBLISHING 


Chapter 9 


Test your understanding answers 


Test your understanding 1 


Reporting system 


The chief internal auditor at Barker Co reports into the finance director. 
This limits the effectiveness of the internal audit reports as the finance 
director will also be responsible for some of the financial systems that 
the internal audit function is reporting on. Similarly, the chief internal 
auditor may soften or limit criticism in reports to avoid confrontation with 
the finance director. 


To ensure independence, the chief internal auditor should report into the 
audit committee, as at Murray Co. 


Recruitment of staff 


All of the internal audit team at Barker Co are recruited by the finance 
director. The finance director may appoint personnel who are less likely 
to be critical of the work of the finance function. To ensure 
independence, the head of internal audit should be appointed by the 
audit committee, and they should then recruit and appoint the rest of the 
team, as at Murray Co. 


Scope of work 


The scope of work of internal audit at Barker Co is decided by the 
finance director in discussion with the chief internal auditor. This means 
that the finance director may try and influence the chief internal auditor 
regarding the areas that the internal audit department is auditing, 
possibly directing attention away from any contentious areas that the 
director does not want auditing. 


To ensure independence, the scope of work of the internal audit 
department should be decided by the chief internal auditor, perhaps with 
the assistance of an audit committee, as at Murray Co. 


Audit work 


The internal audit team at Barker Co review their own work. This limits 
independence as the auditor may overlook or fail to identify errors or 
deficiencies in those areas. This is a self-review threat. 


If possible, the internal audit team should not have operational 
responsibility. However, if this is not possible, the internal audit work 
should be arranged as at Murray Co, so that no member of the team 
reviews areas where they have operational responsibility. 
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Lengths of service of internal audit staff 


The internal audit staff of both companies have been employed for a 
long time. This may limit their effectiveness as they will be very familiar 
with the systems being reviewed and therefore may not be sufficiently 
objective to identify errors in those systems. 


However, there are sufficient staff at Murray Co to ensure that the team 
can be rotated into different areas of internal audit work, and their work 
can be independently reviewed. Due to the small number of staff in the 
internal audit team, Barker Co may not be able to achieve this. 


Given the extent of limitations, it may be appropriate for Barker Co to 
outsource its internal audit function. 


Variation of standards 


Staff at Barker Co follow the auditing standards with which they are 
familiar. Standards of internal audit are not uniform across the 
profession. This could lead to inconsistency in the way each internal 
audit assignment is performed. This can lead to manipulation of internal 
audit aims and measurement. Barker Co should follow an agreed, 
recognised set of professional internal audit standards, such as those 
followed by Murray Co. 


Test your understanding 2 


(a) Benefits of outsourcing to NFA 
Expertise available 


NFA will be able to provide the necessary expertise for internal 
audit work. They may be able to provide a broader range of 
expertise as they serve many different clients, therefore staff may 
be available for specialist work that Octball Co could not afford to 
employ. 


Obtain skills as and when required 


If internal audit is only required for specific functions or particular 
jobs each year then the expertise can be purchased as required. 
Taking this approach will minimise in-house costs. 
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Independence 


As an independent firm which does not perform the audit of the 
financial statements, it is likely that they can provide a high level of 
service with appropriate objectivity. In particular, there will be no 
self-review threats. 


Audit techniques - training 


Outsourcing will remove the need for training internal staff. The 
outsourcing firm will be responsible for training its staff and 
keeping them up-to-date with new auditing techniques and 
processes. 


Continuity of service — staffing 


As provision of internal audit services is NFA’s main activity, they 
should also be able to budget for client requirements. As a larger 
internal auditing firm, they may be able to offer staff better career 
progression which should assist staff retention. 


Problems with outsourcing to NFA 
Fee pressure 


NFA may experience some fee pressure, but only in respect of 
maintaining cost effectiveness of the internal audit department. 
The relationship needs to be managed carefully to ensure that 
NFA does not decrease the quality of its work due to insufficient 
fees. 


Knowledge 


NFA will not have any prior knowledge of Octball Co. This is a 
disadvantage as it will mean the partnership will need time to 
ascertain the accounting systems and controls in Octball Co 
before commencing work. However, provision of an independent 
view may identify control deficiencies that the current internal audit 
department have missed. 


Location 


NFA may not be able to provide this service to Octball Co as they 
are a local firm and therefore the issue of travel and working away 
from home would remain. 
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(b) 


Matters to be considered by T&M 
Independence 


T&M need to ensure that independence can be maintained in a 
number of areas: 


- Independence regarding recommending systems or 
preparing working papers and subsequent checking of those 
systems or working papers. While the internal audit 
department may need to carry out these functions, T&M 
must ensure that separate staff are used to provide the 
internal and external audit functions. 


— Staff from T&M will be expected to follow the ethical 
guidance of ACCA which means that steps will be taken to 
avoid conflicts of interest or other independence issues such 
as close personal relationships building up with staff in 
Octball Co. Any real or perceived threats to independence 
will lower the overall trust that can be placed on the internal 
audit reports produced by T&M. 


Skills 


T&M must ensure that it has staff with the necessary skills and 
sufficient time to undertake the internal audit work in Octball Co. 
As a firm of auditors, T&M will automatically provide training for its 
staff as part of the in-house compliance with association 
regulations (e.g. compulsory CPD). T&M will need to ensure that 
staff providing the internal audit function to Octball Co are aware 
of relevant guidance for internal auditors. 


Fee pressure 


There may be fee pressure on T&M, either to maintain the cost 
effectiveness of the internal audit department, or to maintain the 
competitiveness of the audit fee itself in order to keep the internal 
audit work. 


Knowledge 


As the external auditor, T&M will already have knowledge of 
Octball Co. This will assist in establishing the internal audit 
department as systems documentation will already be available 
and the audit firm will already be aware of potential deficiencies in 
the control systems. 
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(c) 


Controls to maintain the standard of the internal audit 
department 


If T&M is appointed, the internal and external audits should 
be performed by different departments within the firm. 


Performance measures such as cost, areas reviewed, etc. 
should be set and reviewed. Explanations should be 
obtained for any significant variances. 


Appropriate audit methodology should be used, including 
clear documentation of audit work carried out, adequate 
review, and appropriate conclusions drawn. 


Working papers should be reviewed, ensuring adherence to 
International Standards on Auditing where appropriate and 
any in-house standards on auditing. 


The work plan for internal audit should be agreed prior to the 
work commencing and this should be followed by the 
outsourcing company. 


Test your understanding 3 


4 


Cc 


Internal auditors should not implement new controls as 
this would create a self-review threat when the controls 
are tested at a later date. 


Internal audit work may be determined by management or 
the audit committee if there is one. External audits must 
be conducted in accordance with ISAs. 


An audit opinion presented to the shareholders must be 
expressed by an independent external auditor. 


Ethical guidance issued to external auditors requires 
separate teams to provide internal and external services. 
Therefore the internal audit staff assigned will not have 
existing knowledge gained from the external audit. 


5 


Internal audit reports must be produced in a True | False 
standardised format as set out by the financial 
reporting framework 


Internal audit reports are issued to shareholders True | False 


There is no legal requirement for companies to have | True | False 
an internal audit department 


The presence of an internal audit function may act True | False 
as a deterrent for fraud 
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Chapter learning objectives 


This chapter covers syllabus areas: 

. D2 — Audit procedures 

. D4 — The audit of specific items 
. D7 — Not-for-profit organisations 


Detailed syllabus objectives are provided in the introduction 
section of the text book. 


One of the PER performance objectives 
(PO19) is to collect and evaluate evidence for 
an audit. Carry out an internal or external audit 
from collecting evidence, through to forming an 


opinion. You demonstrate professional 
scepticism and make sure judgements are 
based on sufficient valid evidence. Working 
through this chapter should help you 
understand how to demonstrate that objective. 
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AUDIT PROCEDURES 


1 Exam focus 


We dealt with the principles of audit evidence in an earlier chapter. This chapter 
deals with the application of those principles. 


Audit procedures must be designed to respond to the specific risks of 
material misstatement identified for each individual client. In the exam, you 
should make your answers specific to the scenario. It is highly likely the 
scenario focuses on a specific risk such as valuation of inventory, 
recoverability of receivables, etc. Therefore audit procedures must focus 
on these features rather than general audit procedures over the balance in 
question. 


2 Remember that the auditor's role is to obtain sufficient appropriate 
evidence that the financial statements are prepared in all material respects 
with the relevant financial reporting framework. For this reason, you will 
need to have a good understanding of the accounting standards. 


Writing good audit procedures 


An audit procedure should be a clear instruction of how the audit evidence is to 
be gathered. 


It should contain an ACTION applied to a SOURCE to achieve an OBJECTIVE. 


In other words, it should describe what needs to be done, how it should be done 
and why it should be done. 


2 Read the procedure back and consider whether a person with no audit 
experience will understand it. 
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Example: Audit objective - Test the existence of non-current assets 


Good answer 


Bad answer 


Select a sample of assets from the 
non-current asset register and 
physically inspect them to verify 
existence. 


Check a sample of assets. 


Explanation 


The good procedure above clearly 
states: 


. from where the sample should 
be chosen — the non-current 
asset register 


. how they should be checked — 
physically inspect 


. the objective of the test — 
existence 


The badly worded procedure is not 
sufficiently described: 


. From which population should 
the sample be selected? 


. How should the auditor ‘check’ 
existence? 


. What are the assets being 
checked for? 


Example: Audit objective - Test the v: 


aluation of trade receivables 


Good answer 


Bad answer 


Inspect post-year-end bank 
statements to identify if payment has 
been received post year end. If so, 
agree the amount to the trade 
receivables account at the year end. 


Perform a receivables circularisation 
for a sample of customers to confirm 
the balances are in existence at the 

year end. 


Explanation 


The good answer is a well explained 
procedure which tests the assertion 


of valuation in relation to receivables. 


The bad answer tests the assertion of 
existence, not valuation. It is a well 
written procedure, but not relevant for 
the stated audit objective. 
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This chapter is a starting point to help you familiarise yourself with the 
basic auditing techniques, to allow you to apply them to questions. It is not 
an exhaustive summary of all audit procedures. 


Each section starts with: 


Key assertions - these are the assertions most likely to be at risk, however, the 
auditor must obtain assurance over all relevant assertions. 


Sources of evidence - these are the documents that are likely to provide the 
best evidence over the balance being tested. 


wE There are several ways to design audit procedures: 


. Identify the financial statement assertion to be tested. 


E.g. to test accuracy of a sale the auditor will need to agree the amount on 
the sales invoice matches the amount recorded in the detailed sales 
listing. 


. Identify the sources of evidence available. 


E.g. when testing payroll, evidence can come from payslips issued to 
employees. The auditor can agree amounts recorded on the payslip to the 
amounts recorded in the payroll payment list. 


. Identify the types of procedure the auditor can use from ISA 500. 


E.g. analytical procedures. When testing receivables, the auditor may 
calculate the receivables collection period and compare it with the prior 
year to identify any unusual variation. 


2 Directional testing 


The concept of directional testing derives from the principle of double-entry 
bookkeeping, i.e. for every debit there should be a corresponding credit. 


Directional testing reduces duplication and therefore over-auditing and allows 
for a more efficient audit. Applying this concept, any misstatement of a debit 
entry will also result in a misstatement of a credit entry, e.g. directly testing 
payables for understatement also indirectly tests expenses/cost of sales for 
understatement. 


It is important for the auditor to apply directional testing from the start of the 
transaction to the end (testing for understatement) and then again in reverse 
(testing for overstatement) as a directional test will not be effective if the sample 
is chosen from the wrong population. 


Testing for understatement 
A balance will be understated if: 


. Items that should be included are not included i.e. the balance is not 
complete, or 


. An item which has been included is recorded at an amount lower than it 
should be i.e. the amount is misstated. 
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Testing for understatement tests the assertions of completeness and accuracy 
& valuation. 


To test for understatement, the auditor must select the sample from outside of 
the accounting system and trace the transaction through to the accounting 
system and into the financial statements. 


Source of the Accounting Financial 
transaction/Asset records/ledger statements 


For example, select a sample of goods despatch notes and trace to the related 

sales invoice and into the detailed sales listing to confirm completeness. Finally, 
the total of the detailed sales listing must be agreed to the revenue figure in the 
financial statements. 


Testing for overstatement 
A balance will be overstated if: 
. Items are included that should not be included, or 


. An item which has been included is recorded at an amount higher than it 
should be i.e. the amount is misstated. 


Testing for overstatement tests the assertions of existence, rights and 
obligations, occurrence and accuracy & valuation. 


To test for overstatement, the auditor must first of all agree the figure in the 
financial statements to the accounting system, then select a sample of 
transactions from the accounting system to the relevant supporting 
documentation. 


Financial Accounting Source of the 
statements records/ledger transaction/Asset 


For example, agree the revenue figure in the financial statements to the detailed 
sales listing, then select a sample of sales invoices from the detailed sales 
listing and trace to the actual sales invoice and related goods despatch note to 
confirm occurrence. 
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Bank and cash 

The key assertions for bank and cash are existence and valuation. 
Sources of evidence: 

. Bank confirmation letter 

. Bank reconciliation 

. Bank ledger account 

. Bank statements 


The bank and cash included in the financial statements must exist and be 
included at the appropriate amount. The bank ledger account figure is the 
balance which should be included in the financial statements. This may 
differ to the bank statement balance due to timing differences. Therefore, 
the bank reconciliation must be reviewed to ensure the differences can 
be explained. 


The bank confirmation letter provides direct confirmation of bank 
balances from the bank. It is third party, independent, written evidence 
and therefore very reliable. 


The client must give permission to the bank to release this information to 
he auditor, as they too have a duty of confidentiality to their clients. 


The confirmation request should be sent a minimum of two weeks before 
he client's year end. The letter should include enough information to 
allow the bank to trace the client. The confirmation letter will be sent by 
he bank directly to the auditor’s office. 


Test your understanding 1 — Bank and cash 

Murray Co 
Bank reconciliation as at 31 December 20X4 $ 
Balance per bank ledger account (180,345.22) 
Add Unpresented cheques 2,223.46 
Less Outstanding lodgements (1,600.34) 
Difference 1.34 
Balance per bank statement (179,720.76) 
Required: 

Describe substantive procedures the auditor should perform to 

obtain sufficient and appropriate audit evidence in relation to 

Murray Co’s year-end bank balances. 
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Wimble & Co 
14 The Grove 
Kingston 
KI4 6AP 
Manager (Audit Confirmations) 
National Bank Anytown Branch 
High Street, Anytown, AT1 1 HS 


14 December 20X4 
Dear Sir, 
Re: Murray Co 


In accordance with the agreed practice for provision of information to 
auditors, please forward information on our mutual client as detailed 
below on behalf of the bank, its branches and subsidiaries. This request 
and your response will not create any contractual or other duty with us. 


Company name: Murray Co 

Main account number: 01789311 

Sort code: 04-83-12 

Information required 

. Standard x 

. Trade finance x 

. Derivative and commodity trading 
. Custodian arrangements 

. Other information (see attached) 
Audit confirmation date: 31/12/X4 


The Authority to Disclose Information signed by your customer is 
already held by you. This is dated 30/11/X4. Please advise us if this 
Authority is insufficient for you to provide full disclosure of the 
information requested. 


The contact name is: Don Henman (Audit engagement partner) 
Telephone: 01234 123456 

Yours faithfully, 

Wimble & Co 


Wimble & Co 
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Cash counts 


Where cash in hand is material, or when fraud is suspected, a cash 
count should be arranged to verify existence. 


The auditor should make sure that all cash balances are counted at the 
same time to avoid manipulation of the balances between different sites. 


The auditor should always be accompanied by a member of the client 
staff to avoid any allegations from the client of theft by the auditor. 


The details of the cash counts should be recorded, such as the locations 
counted, the amount counted at each location, the client staff present, 
the auditor performing the tests and the date performed. 
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The key assertion for liabilities is completeness and valuation. 
Sources of evidence: 

. Loan agreement 

. Bank ledger account 

. Bank statements 

. Bank confirmation letter 


The loan balances must be complete and valued appropriately in the 
financial statements. Allocation must be assessed as the client should 
show how much of the loan is due to be paid within one year (included as 
a current liability) and how much of the loan is due to be paid outside of 
one year (included as a non-current liability). 


The bank confirmation letter will provide details of loans held, the 
amounts outstanding, accrued interest and any security provided in 
relation to those loans. 


Third-party evidence will be available in the form of the bank confirmation 
letter and the original loan agreement. 
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Procedures include: 


Obtain a breakdown of all loans outstanding at the year end, cast to verify 
arithmetical accuracy and agree the total to the financial statements: 
completeness. 


Agree the balance(s) outstanding to the bank confirmation letter: 
accuracy & valuation, rights & obligations. 


Inspect the bank confirmation letters for any loans listed that have not 
been included in the financial statements: completeness. 


Inspect the bank confirmation letter for details of any security over assets 
and agree the details to the disclosure in the financial statements: 
presentation. 


Inspect financial statements for disclosures of interest rates, and the split 
of the loan between current and non-current: allocation, classification, 
presentation. 


Recalculate the split between current and non-current liabilities: 
allocation, classification, and presentation. 


Inspect the loan agreement for restrictive covenants (terms) and 
determine the effect of any loan covenant breaches: allocation, 
classification, presentation. [If loan covenants have been breached the 
loan may become repayable immediately and should therefore be included 
as a current liability]. 


Inspect the bank ledger account for loan repayments made: existence, 
accuracy & valuation. 


For the related finance cost in the statement of profit or loss, recalculate 
the interest charge and any interest accrual in accordance with terms 
within the loan agreement, to ensure mathematical accuracy: accuracy of 
finance costs in the statement of profit or loss, completeness of accruals. 
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ES The key assertions for non-current assets are existence, valuation, 
completeness and rights and obligations. 


Sources of evidence: 

. Non-current asset register 

. Purchase invoices (additions) 

. Sales invoices/asset disposal forms (disposals) 
. Bank statements and bank ledger account 

. Physical assets 


. Ownership documents including title deeds and registration 
documents 


. Depreciation policy and rates 
. Asset expenditure budgets/asset replacement plans 


Non-current assets must exist, be completely recorded, be valued 
appropriately and must be owned or controlled by the entity. 


The auditor needs to obtain sufficient appropriate evidence over: 
. Existing assets i.e. assets purchased in previous periods 

. Additions 

. Disposals 

. Revaluations 

. Depreciation 


. Related disclosures (the property, plant and equipment note, 
depreciation policies, useful economic lives, revaluations). 
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Test your understanding 2 — Non-current assets 


Murray Co 
Non-current assets: Property, plant and equipment note 

Land & Fixtures, Motor Total 

buildings fittings & vehicles 
equipment 
$000 $000 $000 $000 

Cost at 1 January 20X4 3,000 2,525 375 5900 
Additions - 1,050 75 1,125 
Disposals - (300) - (300) 
Cost at 31 December 
20X4 3,000 3,275 450 6,725 
Accumulated 
depreciation at 
4 January 20X4 386 489 125 1,000 
Charge for the year 97 338 56 491 
Disposals - (116) - (116) 
Accumulated 
depreciation at 
31 December 20X4 483 711 18141 1,375 
Carrying amount at 
31 December 20X4 2,517 2,564 269 5,350 
Carrying amount at 
31 December 20X3 2,614 2,036 250 4,900 
Required: 


Describe substantive procedures the auditor should perform to 
obtain sufficient and appropriate audit evidence in relation to 
Murray Co’s year-end non-current assets. 
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The depreciation charge for fixtures and fittings for the year ended 
31 December 20X4 included in the draft financial statements of Murray 
Co is $338,000 (to the nearest $000). 


Murray Co's depreciation policy is to depreciate fixtures and fittings 
using the straight-line-method. The useful economic life for fixtures and 
fittings is ten years. 


Exercise: 


Create an expectation of the fixtures and fittings depreciation 
charge for the year ended 31 December 20X4. 


Solution 


The total cost of fixtures and fittings in the draft financial statements of 
Murray Co is $3,275,000 (to the nearest $000). 


We can set an expectation for total depreciation for fixtures and fittings 
for the year ended 31 December 20X4 as $3,275,000/10 = $328,000 (to 
the nearest $000). 


The difference of $10,000 is 3% more than our expectation. If this is 
within an acceptable level of variation (as determined by the judgement 
of the auditor) the auditor will conclude that depreciation is not materially 
misstated. 


Intangible non-currentassets — —— — — — ——— 


Development costs 


<> 


The key assertion for development costs is existence. 
Sources of evidence: 

. Breakdown of expenditure during the year 

. Purchase invoices 

. Bank statements and bank ledger account 

. Timesheets 

. Development expenditure/project plans 

. Project test/trial results 

. Cash flow forecasts 

. Licence agreement 

. Third-party valuation report e.g. for brand names and trademarks 


. Amortisation policy and rates 
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Development costs should only be capitalised as an intangible asset if the 
2 recognition criteria of IAS 38 Intangible Assets have been met. The audit 

procedures suggested below focus on obtaining evidence that the 

treatment of the relevant item complies with these requirements. 


Procedures include: 


. Obtain a breakdown of capitalised costs, cast for mathematical accuracy 
and agree to the amount included in the financial statements valuation. 


. For a sample of costs included in the breakdown, agree the amount to 
invoices or timesheets: valuation. 


. Inspect board minutes for any discussions relating to the intended sale or 
use of the asset: existence. 


. Discuss details of the project with the project manager or management to 
evaluate compliance with IAS 38 criteria: existence. 


. Inspect project plans and other documentation to evaluate compliance 
with IAS 38 criteria: existence. 


. Inspect budgets to confirm financial feasibility: existence. 


. Review the financial statement disclosure in the draft financial statements 
to ensure compliance with IAS 38: presentation. 


Other intangible assets 


. Inspect purchase documentation for the company name and the cost of 
the purchased intangible assets: existence, rights and obligations and 
valuation. 

. Inspect specialist valuation report and agree to the amount included in the 


general ledger and the financial statements: valuation. 


Amortisation 


. Inspect the budgets/forecasts for the next few years to ascertain the 
period over which economic benefits are expected to be generated and 
compare with the amortisation policy, to assess reasonableness of the 
amortisation period: valuation. 


. Recalculate the amortisation charge to verify arithmetical accuracy: 
accuracy, valuation. 


. For intangibles such as licences, inspect the licence agreement to confirm 
the amortisation period corresponds to the licence period: valuation. 
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5 Inventory 


ES The key assertions for inventory are existence, valuation, completeness 
and rights and obligations. 


Sources of evidence: 

. Aged inventory listing 
. Inventory assets 

. Inventory count sheets 
. Purchase invoices 

. Goods received notes 
. Sales invoices 

. Goods despatch notes 


. Client calculations of overhead allocation, absorption and 
apportionment and percentage of completion for work-in-progress 


Inventory assets must exist, be completely recorded, be valued 
appropriately and must be owned or controlled by the entity. 


When auditing inventory there are two main factors to consider 
. Quantity of inventory — determined by the inventory count 


. Valuation of the individual inventory items — usually assessed at the 
final audit. 


ISA 501 Audit Evidence — specific considerations for selected items requires the 
auditor to: 


. Attend the physical inventory count (unless impracticable), if inventory is 
material to the financial statements, and 


. Perform procedures on the final inventory records to determine whether 
they accurately reflect the count results. 


Inventory counts 


The client must ascertain the quantity of inventory before valuing it in 
accordance with IAS 2 Inventories. To ascertain inventory quantities, the client 
will perform an inventory count which the auditor must attend if inventory is 
material to the financial statements. 


The inventory count is the responsibility of the client. The auditor does not 
perform the count. 


The auditor's attendance at the inventory count is required to: 


. Evaluate management's instructions and procedures for the inventory 
count. 


. Observe the performance of the count. 
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. Inspect the inventory for existence and condition. 

. Perform test counts to confirm accuracy of the client's counts. 
[ISA 501, 4] 

There are two main methods for counting inventory: 

. a full year-end count 


. a perpetual inventory system 


Full year-end count 


A full year-end count is performed by the client to determine the quantity of 
inventory for inclusion in the financial statements. The count should take place 
on the last day of the financial year if possible. If not, it should take place as 
close to the year end as possible, and adjustments, referred to as a roll-back or 
roll-forward, will be made for goods received and despatched on the days 
between the year end and the date of the count. Where the count does not take 
place at the year end, these adjustments increase the risk of misstatement of 
inventory and the auditor must carefully test them. 


Perpetual inventory system 


A perpetual, or continuous inventory system, is one which keeps a real time 
track of inventory. As a sale is made, the inventory system is updated to reflect 
the reduction in quantity. As purchases are received, the system is updated to 
reflect the increase in quantity. This enables the business to know its inventory 
balance at any point in time. 


Over time, the inventory levels stated in the perpetual inventory system may 
gradually diverge from actual inventory levels, due to unrecorded transactions 
or theft, so periodically, a count should be performed to compare system 
balances to actual quantities and the system can be updated accordingly. 


Where the client uses a perpetual inventory system, lines of inventory are 
counted periodically (say monthly) throughout the year so that by the end of the 
year all lines have been counted. 


Where the client uses this type of system the auditor should: 


. Attend at least one count to ensure adequate controls are applied during 
the counts (in the same way as for a year-end count). 


. Inspect the number and value of adjustments made as a result of the 
count. If significant adjustments are required after each count, this would 
indicate that the system figures for inventory cannot be relied upon at the 
year end and a full count will be required. 


. If the system balance for inventory is deemed reliable as a result of these 
procedures, further procedures to verify valuation and rights will still be 
required. 
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Advantages of perpetual counts 


Reduces time constraints for the auditor, and enables them to attend 
counts relating to lines at greater risk of material misstatement. 


Slow-moving and damaged inventory is identified and adjusted for in the 
client's records on a continuous basis meaning the year-end valuation 
should be more accurate. 


Disadvantages of perpetual counts 


The auditor will need to obtain sufficient appropriate evidence that the 
system operates effectively at all times, not just at the time of the counts 
they attend. 


Additional procedures will be necessary to ensure that the amount 
included for inventory in the financial statements is appropriate, 
particularly with regard to cut-off and year-end allowances. 


Controls over the count(s) 


It is important for the count(s) to be performed effectively to ensure inventory 
quantities are accurately ascertained. Adequate controls must be implemented 
such as: 


Segregation of duties by having the count performed by non-warehouse 
staff. 


No movement of inventory while the count takes place. 


A system for allocating inventory to counting teams to ensure all inventory 
is counted but not duplicated. 


A system for identifying inventory which should not be valued at cost. 


A system to ensure inventory belonging to third parties is not included in 
he count. 


A system to ensure that any inventory stored elsewhere is counted and 
included in the company’s count records. 


Additional considerations at the inventory count(s) 


Cut-off procedures 


The inventory count(s) will be affected by goods despatched and goods 
received. 


During the count, inventory movements should preferably stop to enable 
the count to be conducted without being affected by deliveries. 


For some organisations this won't be possible as they may operate 
production and deliveries 24 hours a day. 
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In these types of organisations, the client should move the items 
requiring despatch to a different location to that being counted prior to 
the count taking place. Any deliveries of goods should be made to a 
different location while the count is ongoing to enable the count to be 
conducted without movement of items. 


A separate count can then be performed on the items delivered during 
the count and these can be added to the warehouse items counted. 


By having such controls in place, the completeness and existence of 
inventory at the count date can be verified as well as the cut-off 
assertion for purchases and sales. 


Third-party inventory stored at the client 


If the client stores inventory on behalf of a third party, they should have 
procedures in place to ensure this inventory is not included in their own 
records. During the inventory count(s) the inventory belonging to a third 
party must be separately identifiable, and preferably moved to different 
location, to minimise the risk of it being counted as part of the client's 
inventory which would overstate the inventory balance in the financial 
statements. 


Inventory stored at a third party 


Some clients will not have space to store all of their inventory and may 
use a third-party storage facility. The inventory held at a third-party site 
still needs to be counted and included in the client's inventory records. 
The auditor will need to obtain sufficient appropriate audit evidence that 
the inventory actually exists and belongs to the client. 


Procedures include: 


. Where a third party holds inventory on behalf of the client, obtain 
external confirmation from the third party of the quantity and 
condition of the goods to confirm rights and valuation. 


. If inventory held by the third party is material, the auditor should 
visit the site to verify existence of the inventory. 


. The auditor can also obtain a report from the third-party’s auditors 
confirming the reliability of the internal controls at the third party. 


Audit 


procedures on the final inventory records 


At the 


final audit, the auditor will need to perform audit procedures over the 


assertions such as cut-off, valuation, rights and obligations, classification and 
presentation. 


Procedures will need to be appropriately designed for the type of inventory e.g. 
raw materials, work-in-progress, and finished goods. 


If a client uses a standard costing system rather than actual costs, additional 
procedures will need to be performed. 
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Typical audit procedures performed at the final audit 


Inspect GRNs and GDNs around the year end to confirm correct cut-off. 
Goods received before the year end should be traced through to inclusion 
in the inventory listing whilst goods received after the year end should not 
be included. Similarly, goods despatched before the year end should not 
be included within inventory whereas goods despatched post year end 
should be included in the year-end inventory balance. 


Review purchase invoices and post-year-end sales invoices to ascertain if 
net realisable value (NRV) is above cost or if an adjustment is required. 


Calculate and compare the inventory holding period with prior year to 
identify slow-moving inventory which needs to be written down to the lower 
of cost and net realisable value. 


Inspect purchase invoices for the name of the client to confirm rights and 
obligations. 


Review the disclosures in the financial statements to ensure compliance 
with applicable financial reporting framework e.g. carrying amount of 
inventory by category such as raw materials, work-in-progress and 
finished goods, accounting policies used, details of any write-downs during 
the year. 


Work-in-progress (WIP) 
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Obtain a schedule itemising the jobs included in WIP at the year end, cast 
it and agree the total to the general ledger and draft financial statements. 


Agree a sample of items from the schedule to the inventory count records 
to confirm existence. 


Agree costs to supporting documentation such as supplier’s invoice and 
payroll records. 


For overheads absorbed into the WIP valuation, discuss the absorption 
method used with management and assess its reasonableness. 


Discuss with the production manager how the percentage of completion 
has been determined at the year end and agree the stage of completion to 
the inventory count records. 


Confirm that net realisable value is greater than cost by comparing the 
contract price with the WIP value plus costs to complete. 


To assess the completeness of WIP, select a sample of customer orders 
and trace through to the list of jobs included in the WIP schedule. 
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Standard costs 


Standard costs are often used by manufacturing companies where it would be 
too time-consuming to collect actual cost information for each individual unit 
produced. The company establishes an expected cost of producing one item 
based on a normal level of activity. This is used to value the inventory. 


Any difference between actual cost and standard cost is taken to a variance 
account in the statement of profit or loss. A large variance on the variance 
account would indicate that the standard costs are not a close approximation of 
the actual costs and therefore the inventory valuation will not be reliable. 


Standard costs are more likely to be reliable if they are updated on a regular 
basis. How frequently the standard costs should be updated will depend on how 
often the cost of components used in the manufacturing process changes. 


Audit procedures must be performed to assess the reasonableness of the 
standard costs as a means of valuing inventory, including: 


. Obtain the breakdown of the standard cost calculation and agree a sample 
of costs to invoices. 


. Enquire of management the basis for the standard costs and how often 
they are updated to reflect current costs. 


. Inspect the variance account and assess the level of variance for 
reasonableness. Discuss with management any significant variances 
arising. 


qj Test your understanding 3 — Inventory 


Murray Co's inventory count instructions are as follows: 
1 A finance manager must supervise the inventory count. 


2 No goods are to be received or despatched during the inventory 
count. 


3 Each team will consist of two members of staff from the finance 
department. One person must count the items. The second 
person will record the count on sequentially numbered count 
sheets. 


4 The teams will be allocated a team number and will be provided 
with a map of the warehouse. Each area of the warehouse is 
marked on the map with the number of the team that is to count 
inventory in that area. The warehouse manager will be in 
attendance to ensure each team is clear about which area they 
are counting, before it is counted. 


5 Once a section is counted it must be tagged to confirm it has been 
counted. Yellow tags are to be used by the first counting team to 
confirm the count has been performed. 
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11 


12 


13 


Once the first count is complete, a second count will take place, 
with each team counting an area that they were not responsible 
for on the first count (according to the warehouse map). Any 
discrepancies should be notified to the finance director 
immediately. Green tags are to be used to confirm the count has 
been checked by a second team. 


Sequentially numbered count sheets will contain the product 
description from the inventory system but no system quantities. 


Any items of inventory in the warehouse that are not listed on the 
count sheets should be recorded on a blank, sequentially 
numbered count sheet. 


Inventory count sheets must be recorded in ink. If a mistake is 
made, it should be crossed out neatly and the correct information 
written next to it. 


Any damaged or obsolete items will be moved to a designated 
area. After the count, an assessment of the goods will be made by 
the finance manager with advice from a sales manager and the 
warehouse manager, to determine the allowance appropriate for 
the condition of the items. 


After the count, the finance manager should review the 
warehouse to ensure all sections have been tagged with both 
yellow and green tags to confirm the count is complete. 


The count sheets must be signed by each team member 
responsible for completing the sheets and returned to the finance 
manager who will perform a sequence check to confirm all count 
sheets have been returned. 


The finance manager will compare the inventory count sheets to 
the inventory records and any adjustments will be updated by 
another finance manager not involved in the count. 


Required: 


(a) 


(b) 


(c) 


Describe the procedures that should be performed by the 
auditor before attending the inventory count of Murray Co. 


Describe the audit procedures that should be performed 
whilst in attendance at the inventory count of Murray Co. 


Describe the substantive procedures that should be 
performed during the final audit of Murray Co. 
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Receivables 


2 The focus of testing for receivables is valuation and existence. 


Sources of evidence: 

. Aged listing of individual customers 

. Sales invoices 

. Goods despatch notes 

. Receivables circularisation letters 

. Post-year-end bank statements 

. Policy for allowance for doubtful receivables 


The receivables balance included in the financial statements must exist 
and be included at the appropriate amount. 


Receivables will be overstated if irrecoverable receivables have not been 
written off or doubtful receivables have not been written down. Audit 
procedures will therefore obtain evidence regarding the recoverability of 
amounts outstanding at the year end. 


Third-party evidence will be obtained in the form of a receivables 
circularisation letter which will confirm existence of amounts outstanding at 
he year end. 


Receivables circularisations 


The auditor will send a circularisation letter to a sample of customers 
asking them to confirm the balance owed to the client at the year end. 
This is considered to be a reliable source of evidence for certain 
financial statement assertions, such as existence, because it is 
documentary evidence sent directly to the auditor from an external 
source. They will not be reliable evidence for the valuation assertion as 
the customer only confirms the transaction price and does not have to 
state any intention to pay the invoice. 


Circularisation letters can be positive or negative. 


A positive receivables circularisation requires customers to respond 
to the auditor's request for information. The auditor can include the 
balance per the client's records and ask the customer to reply stating 
whether or not the balance is correct. Alternatively, the auditor can ask 
the customer to respond by stating the balance they believe they owe 
the client, but the auditor does not provide the balance per the client's 
records to the customer. 


A negative receivables circularisation requests customers to respond 
only if they disagree with the balance provided by the auditor. This is 
only suitable if the risk of material misstatement is low as the customer 
may confirm an incorrect balance if it is in their favour. 
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Steps in undertaking a positive receivables circularisation 


Obtain consent from the client to perform the circularisation. 


Obtain a list of individual customers with balances outstanding at 
the year end, cast this and agree it to the trade receivables 
account. 


Select a sample from the receivables list ensuring that a number of 
nil, old, credit and large balances are selected. 


Circularisation letters should be prepared on the client's letterhead 
paper, requesting a confirmation of the year-end receivables 
balance, and for replies to be sent directly to the auditor's office 
using a pre-paid envelope. 


An appropriate member of client staff, such as the finance director, 
should be requested to sign all the letters prior to them being sent 
out by a member of the audit team. 


Where no response is received, follow this up with another letter or 
a phone call and where necessary alternative procedures should 
be performed such as after-date cash testing and inspection of 
sales invoices and GDNs relating to the receivable. 


When replies are received, they should be reconciled to the client's 
receivables records, and any differences such as cash or goods in 
transit should be investigated further. 


ma! ISA 505 External Confirmations 


ISA 505 External Confirmations requires the auditor to maintain control 
over external confirmation requests when using external confirmations 
as a source of audit evidence. 


This can be achieved by the auditor: 


Preparing the confirmation letters, determining the information to 
be requested and the information that should be included in the 
request. 


Selecting the sample of external parties from which to obtain 
confirmation. 


Sending the requests to the confirming party. 


[ISA 505, 7] 
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Customer Co 
Customer’s address 
7 January 20X5 
Dear Sirs 


As part of their normal audit procedures we have been requested by 
our auditors, Wimble & Co, to ask you to confirm the balance on your 
account with us at 31 December 20X4, our year end. 


The balance on your account, as shown by our records, is shown 
below. After comparing this with your records will you please be kind 
enough to sign the confirmation and return a copy to the auditor in the 
prepaid envelope enclosed. If the balance is not in agreement with your 
records, will you please note the items making up the difference in the 
space provided. 


Please note that this request is made for audit purposes only and has 
no further significance. 


Your kind co-operation in this matter will be greatly appreciated. 


Yours faithfully 

Chief rtecountaut 
Murray Co 

Wimble & Co address 


Dear Sirs 


We confirm that, except as noted below *, a balance of $XX was owing 
by us to Murray & Co at 31 December 20X4. 


(space for customer's signature) 
* Details of differences 
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"7 January 20X5": The confirmation letter should be sent as soon as 
possible after the year end, to increase the chance of an accurate 
and timely response. 


"As part of their normal audit procedures, we have been requested by 
our auditors to confirm the balance on your account with us at 

31 December 20X4... please be kind enough to sign the confirmation 
and return a copy to the auditor..." It is the client who writes to their 
customers requesting the information but the response must be sent 
directly to the auditors to reduce the risk of the client interfering with 
any response. 


"in the prepaid envelope enclosed": Making it as easy as possible to 
respond increases the chance that sufficient customers will confirm 
balances for it to be a valid audit test. 


"If the balance is not in agreement with your records, will you please 
note the items making up the difference in the space provided": 
Requesting the customer to complete the reconciliation increases the 
reliance the auditor can place on this evidence (although the auditor will 
review the reconciliation and investigate any unreconciled differences 
or disagreements). 


Prepayments 


Prepayments are services or goods which a company has paid for in advance. 
The client should include the value of any prepayments as a receivable in the 
financial statements. 


. Inspect bank statements and bank ledger account to ensure payment has 
been made before the year end: existence. 


. Inspect invoices to ensure payment relates to goods or services not yet 
received: existence. 


. Recalculate the amount prepaid to confirm mathematical accuracy: 
valuation. 


. Compare prepayments with the prior year to identify any missing items 
or any new prepayments which require further testing: existence, 
valuation, and completeness. (Analytical procedure). 
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Test your understanding 4 — Receivables 


Murray Co 


Aged receivables analysis at 31 December 20X4 ($000) 


Ref Customer Total Current 30-60 60-90 90-120 120 

Name days days days days 
A001 Anfield 

United Shop 176 95 76 5 0 0 
B001 Bibs and 

Balls 0 0 (24) 0 24 0 
B002 The Beautiful 

Game 84 62 (0 20 (0 2 
B003 Beckham's 42 32 10 0 (0 0 
C001 Cheryl & 

Coleen Co 12 12 0) ie) 0) (0) 
D001 Dream 

Team 45 0 31 14 0 0 
E001 Escot 

Supermarket 235 97 65 0 0 73 
G001 Golf is Us 211 0 (0 0 100 111 
G002 Green 

Grass 61 50 11 0 0) 0 
H001 HHA Sports 59 40 0 19 (0 0 
J001 Jilberts 21 11 10 0 0 0 
J002 James Smit 

Partnership 256 73 102 34 45 2 
J003 Jockeys 419 278 120 21 0 0 
0001 The Oval 92 48 44 0 0 0 
P001 Pole 

Vaulters 76 0 0) 76 0) 0 
P002 Polo 0 0 0 0 0 0 
S001 Stayrose 

Supermarket 97 24 23 23 27 0 
T001 Trainers and 

More 93 73 20 0 (0 0 
T002 Tike Co (54) 0 0 0 o (64) 
W001 Wanderers 89 60 29 0 0) 0 
W002 Whistlers (9) 645 (654) 0 (0 0 
W003 Walk Hike 

Run 4 0 (0 0 (0 4 
W004 Winners 31 21 10 0 (0 0 
Total 2,040 1,621 (127) 212 196 138 
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Required: 


(a) Identify, with reasons, FOUR trade receivables balances from 
the aged receivables analysis that should be selected for 
further testing. 


(b) Describe substantive procedures the auditor should perform 
to obtain sufficient and appropriate audit evidence in relation 
to Murray Co’s trade receivables. 


Payables and accruals 


Se The focus of testing for liabilities is completeness. 


Sources of evidence: 

. Aged listing of individual suppliers 
. Purchase invoices 

. Goods received notes 

. Post-year-end bank statements 

. Supplier statements 


. Supplier circularisations (where supplier statements are not 
available) 


The payables balance included in the financial statements must be 
complete. 


Payables will be understated if all liabilities in relation to purchases made 
have not been recorded. 


Third-party evidence will be obtained in the form of supplier statements 
and supplier circularisation letters. 


Trade payables 


Procedures include: 


Obtain a list of individual suppliers at the year end, cast to verify 
arithmetical accuracy and agree to the general ledger and the financial 
statements: completeness, classification, presentation. 


Reconcile the total of the list of individual suppliers with the trade payables 
account: completeness. 


Obtain supplier statements and reconcile these to the list of individual 
supplier balances. Investigate any reconciling items: existence, 
completeness, obligations and valuation. 

Note: Supplier statement reconciliations provide the most reliable 
evidence in respect of payables as they provide external confirmation of 
the balance. 
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. Inspect after-date payments, if they relate to the current year then follow 
through to the individual supplier's account or accruals listing: 
completeness. 


. Inspect invoices received after the year end in respect of goods delivered 
before the year end and trace through to the accruals listing: 
completeness. 


. Enquire of management their process for identifying goods received 
but not invoiced and ensure that it is reasonable: completeness. 


. Select a sample of goods received notes immediately before the year end 
and follow through to inclusion in the year-end individual supplier's 
account or accruals listing: completeness of payables and cut-off of 
purchases. 


. Select a sample of payable balances and perform a trade payables’ 
circularisation, follow up any non-replies and any reconciling items 
between the balance confirmed and individual supplier's account: 
completeness and existence. 


. Inspect the list of individual suppliers for any debit balances or any 
significant amounts and discuss with management. Consider 
reclassification as current assets: valuation of payables and 
completeness of receivables, classification. 


. Compare the list of individual suppliers and accruals against the prior year 
list to identify any significant omissions: completeness. (Analytical 
procedure) 


. Calculate the trade payables payment period and compare to prior year, 
investigate any significant differences: completeness and valuation. 
(Analytical procedure) 


Accruals 
Procedures include: 


. Obtain the list of accruals from the client, cast it to confirm mathematical 
accuracy and agree to the general ledger and the financial statements: 
completeness, classification. 


. Recalculate a sample of accrued costs by reference to contracts and 
payment schedules (e.g. loan interest): valuation (accuracy of purchases 
and other expenses). 


. Inspect invoices received post year end to confirm the actual amount and 
assess whether the accrual is reasonable: valuation. 


. Compare the accruals this year to last year to identify any missing items or 
unusual fluctuation in amount and discuss this with management: 
completeness and valuation. (Analytical procedure) 
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Test your understanding 5 — Payables 


Murray Co's trade payables balance at 31 December 20X4 is $1,400,000 
(to the nearest $000). The total balance has already been agreed to the 
trade payables account which shows that trade payables consists of 
fifteen suppliers. 


A junior member of the audit team has been testing five of these 
balances by reconciling supplier statements to the balances on the list of 
individual suppliers. They have been unable to reconcile a material 
balance, relating to Racket Co, which supplies material to Murray Co, for 
stringing tennis rackets. You have been asked for advice on the audit 
work which should be carried out on the differences. 


The balance of Racket Co on Murray Co's purchase ledger is shown 
below: 


Individual supplier account: Racket Co 


Date Type Reference Status Dr Cr Balance 
($) ($) ($) 
10.10 Invoice 6004 Paid 1 21,300 
18.10 Invoice 6042 Paid 1 15,250 
23.10 Invoice 6057 Paid 1 26,340 
04.11 Invoice 6080 Paid 2 35,720 
15.11 Invoice 6107 Paid 2 16,320 
26.11 Invoice 6154 Paid 2 9,240 
30.11 Payment Cheque = Alloc1 61,630 
Discount Alloc 1 1,260 
14.12 Invoice 6285 21,560 
21.12 Invoice 6328 38,240 
31.12 Payment Cheque Alloc2 60,050 
Discount Alloc 2 1,230 
31.12 Balance 59,800 
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Racket Co has sent the following supplier statement: 


Date Type Reference Status Dr Cr Balance 
($) ($) ($) 

07.10 Invoice 6004 21,300 

16.10 Invoice 6042 15,250 

22.10 Invoice 6057 26,340 

02.11 Invoice 6080 37,520 

13.11 Invoice 6107 16,320 

22.11 Invoice 6154 9,240 

10.12 Receipt Cheque 61,630 

04.12 Invoice 6210 47,350 

12.12 Invoice 6285 21,560 

18.12 Invoice 6328 38,240 

28.12 Invoice 6355 62,980 

31.12 Balance 234,470 


Racket Co’s terms of trade with Murray Co allow a 2% cash discount on 
invoices where Racket Co receives payment from the customer by the 
end of the month following the date of the invoice (i.e. a 2% discount will 
be given on November invoices paid by 31 December). 


Under ‘Status’, the cash and discount marked ‘Alloc 1’ relate to the 
invoices marked ‘Paid 1’ (similarly for ‘Alloc 2’ and ‘Paid 2’). 


Murray Co's goods received department checks the goods when they 
arrive and issues a goods received note (GRN). A copy of the GRN and 
the supplier's advice note is sent to the purchases accounting 
department. 


Required: 


(a) Prepare a statement reconciling the balance on Murray Co's 
individual supplier account to the balance on Racket Co’s 
supplier’s statement. 


(b) Describe the audit work you will carry out on each of the 
reconciling items you have determined in your answer to part 
(a) above, in order to determine the balance which should be 
included in the financial statements. 
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Provisions and contingencies 


IAS 37 Provisions, Contingent Liabilities and Contingent Assets requires 
an entity to recognise a provision if: 


. a present obligation has arisen as a result of a past event 
. payment is probable (‘more likely than not'), and 
e the amount can be estimated reliably. 


If payment is only possible, a contingent liability must be disclosed in the 
notes to the financial statements. 


A contingent asset can only be recognised if it is virtually certain to be 
received. If it is probable that an inflow of economic benefits will result, a 
disclosure should be made in the financial statements. If it is only 
possible, it should be ignored. 


Provisions and contingent liabilities 


Audit testing will focus on whether an obligation exists, whether payment 
is probable or possible, and whether the provision is valued appropriately. 


Completeness is a key assertion as the company may understate 
liabilities to improve its financial position. 
Contingent assets 


Audit testing will focus on whether payment is virtually certain or 
probable, and whether the receivable is valued appropriately. 


Existence is a key assertion as the company may overstate contingent 
assets to improve its financial position. 


Examples of contingent assets include: 
. Amounts due to be received from an insurance claim 
. Amounts due to be received in respect of a legal claim 


. Amounts due to be received from a liquidator in respect of an 
investment or bankrupt receivable. 


Procedures include: 


Obtain a breakdown of provisions, cast it and agree the figure to the 
financial statements: accuracy and presentation. 


Enquire with the directors, or inspect relevant supporting documentation, 
to confirm that a present obligation exists at the year end: rights and 
obligations. 


Inspect relevant board minutes to ascertain whether payment is probable: 
existence. 
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Recalculate the liability and agree components of the calculation to 
supporting documentation: completeness. 


Inspect post-year-end bank statements to identify whether any payments 
have been made, compare actual payments to the amounts provided to 
assess whether the provision is reasonable: valuation. 


Review the financial statement disclosure of the provisions and contingent 
iabilities to ensure compliance with IAS 37: presentation. 


Obtain a written representation from management that they believe the 
provisions and contingent liabilities are treated appropriately in the 
financial statements, are valued appropriately and are complete: 
valuation and completeness. 


The statement of financial position shows that Murray Co has a 
provision liability of $240,000 for the year ended 31 December 20X4. 
The majority of the balance relates to provisions for warranties 
($200,000). $40,000 of the provision relates to a claim made by an ex- 
employee of Murray Co who is claiming for unfair dismissal. 


The audit plan includes the following audit procedures in relation to 
these provisions: 
Warranty provision procedures 


. Obtain a breakdown of the warranty provision and recalculate to 
verify arithmetical accuracy. 


. Enquire of management the basis used for the provision and 
assess whether this is reasonable. 


. Compare previous year actual warranty costs with the amount 
provided to assess whether management's process is reasonable. 


. Compare warranty claims post year end to the warranty provision 
at the year end to assess whether the provision is adequate. 


. Review product returns and complaints to assess whether there is 
a need for a higher provision than in previous years. 


. Calculate warranty costs/revenue and compare with prior year to 
assess whether the level of provision is consistent with the prior 
year. Discuss any change in proportion with management. 


Legal provision procedures 


. Enquire with the directors when the employee was dismissed to 
confirm that a present obligation exists at the year end. 


. Inspect correspondence between the employee and Murray to 
verify that the employee was dismissed before the year end. 
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Procedures relevant to both provisions 


Inspect relevant board minutes to ascertain whether it is probable 
that the payment will be made to the employee. 


Obtain confirmation from Murray's lawyer about the likely outcome 
and probability of payment. 


Inspect correspondence received from the lawyer regarding the 
legal provision to assess whether a provision should be recognised 
and if so, whether the amount of the provision is adequate. 


Obtain a breakdown of the costs to be provided and recalculate to 
ensure completeness. 


Agree the components of the calculation to supporting 
documentation, e.g. fee estimate from Murray Co's lawyer, claim 
received from the ex-employee. 


Inspect post-year-end bank statements to identify whether any 


payments have been made and compare actual payments to the 
amounts provided to assess whether the provision is reasonable. 


Obtain a written representation from management to confirm the 
adequacy and reasonableness of the provisions. 


Review the financial statement disclosure to ensure compliance 
with IAS 37 Provisions, Contingent Liabilities and Contingent 
Assets. 


Contingent assets 


Procedures include: 
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Review correspondence from third parties (lawyer, insurance company, 
insolvency practitioner) regarding the value likely to be received and 
probability of payment. Agree the figure into the disclosure note relating to 
he contingent asset: existence, accuracy & valuation and 
presentation. 


Review correspondence from third parties (court, insurance company, 
insolvency practitioner) confirming the amount awarded to the client. 
Agree the figure to other receivables and other income within the financial 
statements: accuracy & valuation, existence, rights & obligations, and 
presentation. 


Review post-year-end bank statements and bank ledger account to 
confirm the amount received: accuracy & valuation, existence, rights & 
obligations, and presentation. 
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AR| ISA 501 Audit Evidence — special considerations for selected items 
ISA 501 requires the auditor to design and perform audit procedures in 
order to identify litigation and claims involving the entity which may give 
rise to a risk of material misstatement. Procedures include enquiring of 


management, reviewing meeting minutes and reviewing legal expense 
accounts. [ISA 501, 9] 


9 Accounting estimates 


2 There are many accounting estimates in the financial statements, 
e.g. allowances for receivables, depreciation of property, plant and 
equipment, provisions, etc. 


Accounting estimates are inherently risky because they relate to the future and 
therefore documentary evidence may be limited. This makes it difficult for the 
auditor to obtain sufficient appropriate evidence regarding the balance. 


Inherent risk is increased because management judgement is needed to 
determine accounting estimates. As a result, estimates may be used to 
manipulate the financial statements and show a desired result. 


Professional scepticism is essential for the auditor to ensure the accounting 
estimates are reasonable and are not being used to introduce bias into the 
financial statements. 


ISA 540 (Revised) Auditing Accounting Estimates and Related Disclosures 
requires the auditor to obtain an understanding necessary to allow the auditor to 
identify and assess the risks of material misstatement relating to accounting 
estimates. [13] 


This involves obtaining an understanding of: 


. The entity's environment including the requirements of the financial 
reporting framework and regulatory factors relevant to accounting 
estimates. [13b, c] 


. The entity's internal controls related to accounting estimates including the 
control activities, the need for specialised skills, and the governance in 
place over the financial reporting process relevant to estimates, and how 
management reviews the outcome of previous accounting estimates and 
responds to the results of the review. [13e, f, j] 


The auditor must separately assess inherent risk and control risk when 
assessing the risk of material misstatement relating to accounting estimates. 
When assessing inherent risk, the auditor should consider: 


. The degree to which the estimate is subject to estimation uncertainty. 


. The degree of complexity and subjectivity involved in the method, 
assumptions and data used to make the estimate. 


. The degree of complexity and subjectivity used in the selection of 
management's point estimate. [16] 
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When responding to the risk of material misstatement in the accounting 
estimates, the auditor must perform the following procedures: 


. Obtain evidence from subsequent events. 
. Test how management made the estimate. 


. Develop an auditor’s point estimate or range. [18] 


10 Share capital, reserves and director's remuneration 
i Each of these areas are material by nature. 
Share capital 


Se Sources of evidence: 

. Share register 

. Share certificates 

. Bank statements and bank ledger account 

. Board minutes 

. Registrar of companies (e.g. Companies House) 
Procedures include: 


. Agree authorised share capital and face value disclosures to underlying 
shareholding agreements/statutory constitution documents. 


. Inspect bank ledger account for evidence of cash receipts from share 
issues and ensure amounts not yet received are correctly disclosed as 
share capital called-up not paid in the financial statements. 


. Inspect board minutes to verify the amount of share capital issued during 
the year. 
Dividends 


Se Sources of evidence: 
. Board minutes 
. Bank statements and bank ledger account 
. Dividend warrant 


Procedures include: 


. Inspect board minutes to agree dividends declared before the year end. 
. Inspect bank statements to agree dividends paid before the year end. 
. Inspect dividend warrants to agree dividend payment. 
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Directors’ emoluments 


2 Sources of evidence: 


. Directors’ service contracts 

. Board minutes 

. Bank statements and bank ledger account 
. Payroll records 


. Written representation from management 


Procedures include: 


Obtain and cast a schedule of directors’ remuneration split between 
wages, bonuses, benefits, pension contributions and other remuneration, 
and agree to the financial statement disclosures. 


Inspect payroll records and agree the figures disclosed for wages, 
bonuses, and pension contributions. 


Inspect bank statements to verify the amounts actually paid to directors. 


Inspect board minutes for discussion and approval of directors' bonus 
announcements or other additional remuneration. 


Obtain a written representation from directors that they have disclosed all 
directors’ remuneration to the auditor. 


Reserves 


Agree opening reserves to prior year closing reserves and reconcile 
movements. 


Agree movements in reserves to supporting documentation 
(e.g. revaluation surplus movements to the independent valuer’s report). 


Statement of profit or loss 


Due to the volume of transactions processed during the year, most 
companies will have controls in place over revenue, purchases and 
payroll. The auditor will therefore seek to place reliance on internal 
controls over these areas. 


Substantive procedures will still need to be performed as these areas will 
be material to the financial statements and the auditor is likely to perform 
substantive analytical procedures as an efficient way of obtaining 
substantive audit evidence where controls are working effectively. 


Some specific tests of detail will be performed when testing the statement 
of profit or loss items. In addition, some evidence will be obtained over 
revenue and purchases indirectly through the direct tests performed on the 
corresponding receivables and payables in the statement of financial 
position (directional testing). 
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Payroll 


2 The focus of testing for payroll is completeness, accuracy and occurrence. 


Sources of evidence: 

. Payroll account 

. Payroll payment listing 

. Payslips 

. Contracts of employment 

. Hourly rates of pay 

. Timesheets 

. Bank statements and bank ledger account 
. Starters and leavers forms 


Payroll will be understated if all employees who should have been paid 
have not been paid. 


Payroll will be overstated if fictitious employees, or employees who no 
longer work for the entity, are paid. 


Payroll will be misstated if errors are made in the payroll calculations. 


Procedures include: 


Agree the total wages and salaries expense per the payroll account to the 
general ledger and the financial statements: completeness and 
presentation. 


Cast the monthly payroll listings to verify the accuracy of the payroll 
expense: accuracy. 


Recalculate the gross and net pay for a sample of employees and agree to 
the payroll records: accuracy. 


Recalculate statutory deductions to confirm whether correct deductions for 
this year have been included within the payroll expense: accuracy. 


Select a sample of joiners and leavers, agree their start/leaving date to 
supporting documentation, recalculate that their first/last pay packet was 
accurately calculated and recorded: completeness, occurrence, 
accuracy. 


For salaries, agree the total net pay per the payroll records to the bank 
transfer listing of payments and to the bank ledger account/cash book: 
occurrence. 


For cash wages, agree that the total cash withdrawn for wage payments 
equates to the weekly wages paid plus any surplus cash subsequently 
banked: completeness, occurrence. 


Agree the year-end tax liability to the payroll records and subsequent 
payment to the post-year-end bank ledger account: occurrence. 


For a sample of individuals, agree the amount per the payroll listing to the 
personnel records, and timesheets if applicable: accuracy. 
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Chapter 10 


Analytical procedures 


ea 


Perform a proof in total of total wages and salaries incorporating joiners 


o the actual wages and salaries in the financial statements and 
investigate any significant differences: completeness, accuracy. 


fluctuations and discuss them with management: completeness, 
accuracy. 


and leavers and any pay increase awarded during the year. Compare this 


Compare the payroll figure for this year to last year to identify any unusual 


Total payroll for the year ending 31 December 20X3 was $1,220,000 
(to the nearest $000). At this time Murray Co had 34 employees. 


Total payroll for the year ending 31 December 20X4 is $1,312,000 (to 
the nearest $000). Murray Co now has 37 employees. 


All employees received a 5% pay rise on 31 March 20X4. 
Exercise: 


Create an expectation of the total payroll cost for year ended 
31 December 20X4. 


Solution 


The average salary per employee in 20X3 was $35,882 
($1,220,000/34). 


All employees received a 5% pay rise in March. The average value of 
this pay rise is therefore $1,346 per employee in 20X4 (5% x 9/12 x 
$35,882). The average salary for 20X4 is $37,228 ($35,882 + $1,346), 
therefore the expectation for total payroll for the year ending 

31 December 20X4 is $1,377,000 (37 x $37,228) to the nearest $000. 


The difference ($65,000) is less than 5% more than our 
expectation. If this is within an acceptable level of variation (as 
determined by the judgement of the auditor) the auditor will 
conclude that the payroll cost is not materially misstated. 
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Procedures 


370 


Revenue 


a The focus of testing for revenue is completeness, cut-off, occurrence and 


accuracy. 

Sources of evidence: 

. Revenue account 

. Detailed sales listing/sales day book 

. Sales invoices 

. Customer contracts 

. Goods despatch notes 

. Sales orders 

Revenue will be understated if all sales transactions are not recorded. 


Revenue will be overstated if fictitious sales, or sales which have been 
returned, are recorded. 


Revenue will be misstated if errors are made in the sales invoice 
calculations. 


Procedures include: 


Inspect a sample of GDNs before and after the year end and ensure they 
have been recorded in the detailed sales listing in the correct period: cut- 
off. 

In most cases, the despatch of goods indicates that the seller has fulfilled 
its performance obligations and therefore the sale can be recorded. 


Recalculate discounts and sales tax applied for a sample of large sales 
invoices: accuracy. 


Select a sample of customer orders and agree these to the despatch 
notes and sales invoices through to inclusion in the detailed sales listing: 
completeness. 


Inspect credit notes issued after the year end, trace to GDN and 
invoice and ensure the sale has been reversed: occurrence. 


Compare revenue against prior year and investigate any significant 
fluctuations: cut-off, occurrence, accuracy and completeness. 


Compare revenue with budget/forecast and investigate any significant 
fluctuations: cut-off, occurrence, accuracy and completeness. 


Calculate the gross profit margin and compare to prior year. Investigate 
any significant differences: cut-off, occurrence, accuracy and 
completeness. 
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